Latest / Parsing the Truth: One Byte at a Time / Karen Read 1-11: Lessons Learned

Transcript

Karen Read 1-11: Lessons Learned · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these bad ass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Parsing the Truth One Bite at a
0:53
Time is proud to welcome our first sponsor, ACE Forensics.
0:57
They are based near Chicago and they've been building systems
1:01
since 1983. ACE Forensics delivers high
1:05
performance digital forensics workstations, laptops and
1:08
servers to justice agencies across the United States and
1:12
around the world. They offer unmatched value and
1:15
the industry's only five year digital forensics warranty.
1:20
ACE Forensics build the systems or digital forensics software
1:23
deserves. If you're procuring digital
1:26
forensics equipment, reach out to them for competitive quote.
1:29
Now on to our episode. Welcome back to Parsing the
1:34
Truth One Bite at a Time. I'm Stacey Eldridge and with me,
1:37
as always, is my Co host, Becky Passmore.
1:40
We are the podcast that focuses on digital forensics and the
1:45
artifacts and the facts of today's modern crimes.
1:48
And we even dive into the courtroom testimonies and what
1:52
those facts reveal to the juries.
1:54
So, Becky, what are we going to do tonight?
1:57
Well. Welcome back everyone.
1:59
Today we are wrapping up the coverage of the first Karen Reed
2:04
trial and we're taking a look back at all the digital evidence
2:09
and the forensics testimony that was covered during this these
2:13
episodes to bring you some lessons that we learned from
2:17
this trial. Yeah, so first up, I want to
2:20
loop back around to something. I had a question in one of the
2:24
previous episodes that we discussed and that was that
2:28
screenshot that was mentioned of Brian Albert's contact
2:33
information that was captured on Jennifer McCabe's phone.
2:38
And I wanted to clarify something for everyone.
2:40
So my question was, you know, was it really a screenshot or
2:44
was it one of those captures that is created when you're
2:48
switching apps? And that was my question.
2:51
Was it really a screenshot or was it related to the app
2:54
Switcher? Well here, here are the facts
2:57
from the actual evidence that we didn't have access to before.
3:00
So let's First off level set. Now the images that are created
3:05
for use with the app Switcher are dot KTX files and they are
3:11
stored generally in a subdirectory of that
3:14
applications data and they're not stored in a database.
3:18
And if you're wondering what a KTX file stands for, it stands
3:22
for Kronos Texture. I didn't know that.
3:26
I was like oh fancy Chronos texture.
3:29
I knew what a KTX file was, but not what it stood for.
3:32
Now these files are an image container made for 3D graphics
3:38
and when the iPhone is creating them, they actually create 21
3:42
for light mode and one for dark mode.
3:45
Now, if it had been a KTX file and was deleted, we wouldn't
3:50
have known about it, since if it was actually deleted, it would
3:54
not have been extracted by Celebrate.
3:57
Also, based on the evidence, that screenshot was indeed a
4:00
user generated screenshot and it was a PNG file.
4:04
Now the question still remains, why was it screenshotted?
4:06
Does it really matter? I don't know, but you know, I
4:09
think it's interesting to, you know, make sure you know that
4:12
this is a screenshot and this is a key KTX and which ones are
4:16
generated and why. Now, a KTX file created by the
4:20
system certainly could show revealing information in your
4:24
case, so they're not to be ignored, but in this case, this
4:27
was just a screenshot that would have been user generated.
4:31
So now we know the answer to that and maybe we've learned
4:34
just a little something about KTX files.
4:36
That's right. Next up.
4:37
The other thing we discussed was airplane mode, and I think this
4:43
came up mostly during Trooper Nicholas Garino's testimony.
4:49
I think Jessica Hyde maybe mentioned it a little bit too,
4:52
but most of it came out during Nick Garino's testimony and we
4:57
are talking about GPS and all that sort of stuff.
4:59
So I think we want to come back around and clarify some
5:03
terminology and make sure we use the appropriate terminology when
5:07
it comes to iPhones and how you should be sharing this
5:10
information with a jury. So level set once again, when
5:14
you put your phone into airplane mode, it does not disable lake
5:18
location services by default. You can't go and swipe down into
5:23
the Control Center and there's nowhere to talk on or off.
5:27
It's just the airplane mode, Wi-Fi, Bluetooth.
5:29
That's what everybody should be concerned with.
5:31
But now what we want to do is tighten up our language around
5:33
this, because I think in the previous episodes we were saying
5:36
there was no way to disable GPS on the iPhone from that option
5:40
from the Control Center. So we should clarify that GPS
5:44
and location services are related, but they're two
5:48
different distinct things. On an iPhone, GPS is one of the
5:52
several data sources that Location Services uses to get
5:58
location data from. There's not an option on your
6:01
iPhone to actually switch the GPS service off, so think of
6:07
Location Services as that umbrella service that manages
6:11
which apps can access location data and which services are used
6:16
to determine your location data. So if you're preserving A seized
6:21
foam, you want to place it in a Faraday bag or Faraday box as
6:26
soon as possible, not just use airplane mode.
6:29
And because if you put it in the Faraday bag, what does it do,
6:32
Becky? Well, it still tries to reach
6:35
out to those signals and it might lose battery quicker and
6:39
faster. Right.
6:40
So you want to try to, you know, think if you put a portable
6:43
battery pack in there, you don't want the power charging cord
6:47
hanging out of that bag because then you've just created a
6:50
little antenna. But the reason your iPhone is
6:53
still searching for signal all the time is that Faraday box,
6:57
that Faraday bag is blocking all of those signals.
7:00
So by doing that, it's preventing any of that location
7:03
data, Wi-Fi data coming in and entering new data on the phone.
7:08
Now. Now it's alleged rumored on the
7:11
Internet that if you say, hey, Siri, turn off location
7:15
services, it will turn off location services.
7:18
I don't know, Becky, do you want to try it on your phone and see
7:20
what it does? Let's.
7:21
Try Hey Siri turn off turn off Location services.
7:27
Turning off location services will disable access to your
7:30
location data for all apps, including Find My.
7:34
Should I go ahead and turn off location services?
7:36
OK. And was your phone locked or
7:38
unlocked when you did that? It was locked.
7:40
OK, OK, so seems like it now. It pops up a little option for
7:46
me to toggle off my location services and so it it it does
7:52
offer a toggle button so if I wanted to do it I I could do it.
7:57
Does that mean all my location and security services are turned
8:02
off or there's still some turned on?
8:04
Yeah, I don't know. But I mean, it's maybe a good
8:07
option. Now I've also said, you know,
8:11
it's maybe not recommended to do that.
8:14
You might get some unexpected results if you say, hey, Siri,
8:18
disable it and it disables it like, I don't know, Will causes
8:20
the iPhone to crash because we certainly don't want it to crash
8:23
and and shut down. You know, like everything, it's
8:26
about managing risk and mitigating the circumstances.
8:30
What data do you need to preserve?
8:32
How so important is that you have that location data shut
8:37
off, Like if you know it's just going to be an hour or two
8:39
before you can get it to wherever you've got to go that
8:42
has a Faraday bag, a room, a box or whatever that's going to
8:45
block those signals. Maybe don't mess with it, but
8:48
maybe it's some sort of remote situation.
8:50
You don't have any Faraday bags. Maybe you want to take that
8:53
risk. It all just depends.
8:56
But if you're in law enforcement or working in an agency or a
8:59
large business group, you might want to do some research,
9:02
testing and valid and come up with a policy.
9:06
And maybe you have different recommendations for different
9:09
circumstances. But the thing we want to
9:11
reiterate here is you've only got 7 days to grab that detailed
9:15
location data. If you don't know what the PIN
9:19
code is, you're going to have to spend some time breaking into
9:21
that phone. Obviously, if you have it under
9:23
consent or somebody knows the PIN code, you can get into it a
9:26
lot faster. And then of course, the other
9:28
question is, is a full file system extraction supported so
9:32
you can get that detailed location data that you want,
9:35
airplane mode and collections being done appropriately in
9:38
Faraday bags? Do they have them or do they
9:40
not? This is not going to be the last
9:42
case that this is going to be talked about in.
9:43
That's right. And, you know, they made a big
9:45
deal about this in the Karen Reed trial because, you know,
9:49
they discussed that, oh, there was all these locations reported
9:52
from within whatever the agency was that was holding the device
9:56
at the time. But it really didn't have
9:59
anything to do with where the phone had been in this case.
10:02
Like, there was no lost data. They were able to recreate where
10:05
the phone was the night of Mr. O'keefe's death from the bar to
10:10
34 Fairview Rd. Oh, Becky, you've talked about
10:13
it was probably a defense strategy, something to harp on.
10:17
They're going to nail you. You didn't follow best
10:19
practices. You could be losing data,
10:22
overriding data. And then it's going to kind of
10:24
lead down that trail of, if you didn't do this right, what else
10:28
are you doing wrong? You know, they're just out there
10:31
throwing doubt around like it's confetti.
10:34
Yeah, that's right. So next we talked about the time
10:38
stamp in a browser. Stamp dot DB is a tab state
10:45
timestamp, not a search timestamp.
10:48
Could the two ever match? Perhaps, But the big take away
10:52
from this trial was that iOS 15 changed this database to only
10:58
write when a tab is closed. The last viewed time reflects
11:03
when that tab last changed focus and was closed, not when a the
11:10
URL was accessed. Much of what that table used to
11:15
do is now to be able to track in memory and not in the table
11:21
itself. It makes sense that there's a
11:23
lot of writing to a database. Celebrate ultimately removed
11:29
this time stamp from its output because it is in and this is, in
11:34
Wiffen's words, wildly inaccurate, but it still exists
11:40
in the raw data. Now, if you want to see this for
11:43
yourself and you don't want to have the ability to create your
11:46
own test data set, you can use one of Josh Hickman's head over
11:51
to his blog at Binary Hick, and he has versions of iOS 13
11:57
through 17 available for download, along with detailed
12:01
notes on the actions taken on these devices.
12:04
And I'll say this much, those iOS versions of iOS that Josh
12:09
Hickman has created as data sets for people to use for training
12:14
purposes, for testing purposes, they're they're they're very
12:18
well written. Yeah.
12:21
So I downloaded the iOS 15 version and I could see the web
12:26
URL in the browser state DB and it did not match the time of his
12:32
searches as documented and corroborated with the history.
12:35
Yeah, this was a big one in this case, right?
12:38
That was sort of the, I don't know, in my opinion that the the
12:41
huge controversial artifact in this case was was the time.
12:45
And people are still upset about this time.
12:51
And, you know, I think if you don't believe it, you're unsure,
12:57
you think that it reflects the search time, then I think you
13:00
should go out and do your own testing and validating because
13:02
this might come out to your case.
13:05
And so you need to understand what you're stating and you need
13:10
to believe what you're stating too is right.
13:13
You can't just say, well, somebody said this and I'm just
13:16
going to take their word for it, especially when this has been
13:18
hot, you know, hugely really contested.
13:20
So if this is important to your case, you know you're going to
13:24
have a hard time on the stand. So you better double down and do
13:28
a bunch of testing because the opposing side isn't going to go
13:31
down without a fight if you're trying to say something from
13:34
this database and the times are super important to your case.
13:38
Right, and tool version matters. These different tool versions
13:43
provide different results. That's why they keep releasing
13:46
new versions, because they can parse more artifacts.
13:50
Celebrate 7.53 dot 0.29 did not parse the search term House Long
13:57
to Die in Cold from the browser State dot DB wall record, which
14:03
was used by Gerano. Version 7.55 was the first
14:09
version capable of parsing that data.
14:11
Version 7.61, point 0.12 is what Richard Green used.
14:18
Rono's original report omitted the artifact entirely because it
14:24
was not support. It was not a supported artifact
14:27
at that time. At the end of the trial, it
14:30
seems it's once again not a supported celebrite artifact.
14:35
So a few key points here is always document which tool
14:40
version produced each finding using a new version of a tool is
14:45
not re examination in the sense that you're not conducting the
14:48
extraction again, but you need to check the search warrant
14:52
again and confer with legal counsel if you can process this
14:57
data again with a newer version of the tool.
14:59
So we go back and look at the results over again all the time
15:04
when preparing for trial prep, but processing with new tools,
15:08
different tools or newer versions of tools, will that be
15:11
a problem in your jurisdiction? Those are good questions and you
15:14
don't want to do something so close to the trial to get your
15:19
data kicked out. It's probably going to be more
15:23
noticeable if you are producing exhibits sort of at the last
15:28
minute with these these new tools.
15:30
And if people catch on to that, they might re raise some
15:33
questions and try to get that stuff tossed out of court.
15:36
So, you know, just, you know, double check, read the search
15:39
warrant again, whatever your legal authority is again and
15:42
make sure that it's OK to do that.
15:45
Other people might have questions.
15:46
Well, why did Greeno use this version and why did Richard
15:49
Green use a newer version? And obviously in the testimony,
15:52
it came back out later that Garino did go back and and use
15:55
newer versions to come up with those same results.
15:58
And it wasn't until Richard Greene affidavit came out.
16:01
But they're using different versions because you know, law
16:05
enforcement is working the case first.
16:07
Then if it goes to trial or they know it's going to trial, that's
16:12
when another digital forensic examiner for the defense is
16:15
brought in. And it kind of depends when
16:18
somebody for the defense gets brought in, are they doing it
16:22
sooner trying to get charges dismissed so it doesn't go to
16:26
trial or they kind of waiting till the last minute.
16:28
But obviously all this time has gone by.
16:30
So I'm using whatever my latest version of my tool is.
16:34
When I get evidence to examine if I'm finding different things
16:38
than what the other side found and they used an older,
16:41
different version of the tool, I might go back and use that older
16:45
version too. But see, that's the thing.
16:47
When you're on the defense side, you're kind of playing by a
16:50
different set of rules. There's a lot more liberty of
16:53
what you can go back and do for sure along the same lines of
16:58
using newer versions, if you can use multiple tools, right?
17:03
And you know, if you're going to use multiple tools, you should
17:06
probably understand what differences are.
17:10
Do you like the way something looks in one tool versus the
17:13
other? Does it make more sense in your
17:15
mind? Do you like how do you can drill
17:16
down in this tool versus the other tool?
17:19
And there was some of that discussed during the testimony
17:22
as well. Greeno himself said he liked to
17:25
ask him for something and celebrate for for other things.
17:27
Law enforcement tends to have a lot more tools available to
17:31
their disposal. If the defense is going to a big
17:33
forensic firm, they have a lot of tools available to their
17:37
disposal. But if you're going to a smaller
17:39
shop like me, I don't have all the things, but I know how to
17:45
use my tools really well, and I have still an alternate version
17:49
of a different tool that I can use, and I can always manually
17:53
parse things if I need to, so that's always an option.
17:57
Sure. But, you know, I think that one
18:00
of the key takeaways about using the multiple tools that
18:03
shouldn't be forgotten is, you know, this house Long to Die in
18:06
cold was parsed by both Celebrite and Axiom.
18:10
It showed up in both of the results.
18:12
So the whole challenge with this in this case was not the fact
18:15
that the tools found it or did not find it.
18:18
It was what the heck did that data mean?
18:20
What the heck did that time stamp mean?
18:23
And how was it interpreted? Yeah, yeah.
18:26
Where? Where did the tools categorize
18:28
it? Because some people, if you're
18:29
relying a lot on where the tool is putting it, what it's
18:32
categorizing at it as, that's going to influence what you
18:35
think that means. But again, what does that time
18:38
stamp mean? If you're not sure, you're going
18:40
to have to do some testing and figure that out, yeah.
18:43
Definitely testing is is part of that process.
18:46
Testing should be completed just like using multiple tools, just
18:50
like checking versions. If you're not testing your data,
18:54
if you don't understand what the tool is parsing and how it's
18:59
interpreting it, do it yourself. Do it manually, figure out how
19:02
to do it. Find some other utilities or
19:04
tools that can help you figure that out for testing.
19:07
So another area we discussed and should be brought up again is
19:12
know the three iPhone clocks, monotonic baseband and display.
19:18
The power log is the only database using monotonic time.
19:22
You can be sure the opposing counsel is going to ask you if
19:26
you know what these are, what they do.
19:30
So when Waze showed a 3 minute discrepancy as discussed in
19:35
Greens testimony, it came from the power log, not from the Waze
19:39
data itself. Know which clock on an artifact
19:45
uses before you interpret it. Going back to know what your
19:49
tool is interpreting and know what that application.
19:53
So in this situation, what the clock artifact is being
19:57
interpreted from the ways application if you need to
20:00
correlate times? Axiom does a great job showing
20:04
you all three when monotonic time is involved in power log
20:09
events. So just do the math as needed
20:12
when seconds and minutes really matter.
20:14
And in this situation, for this trial, in this case, they really
20:18
matter. Yep, absolutely.
20:20
Everybody just start memorizing what these three different
20:23
clocks are because I feel like they're going to ask you just to
20:25
ask you, you're going to be like, you know what the three
20:28
clocks are and you're going to be like, yes, they're going to
20:32
be like. And you know that will just
20:36
again show your confidence level and your knowledge level and you
20:42
just being able to answer that question and providing the end
20:45
results for just knowing what the clocks are.
20:48
And another thing this case really showed was how important
20:52
the totality of evidence is. And it always is.
20:56
It's always all the evidence. It's never one artifact alone in
21:00
isolation. One artifact might suggest one
21:04
thing, give you clues about one thing, you lead you in One
21:06
Direction, but five other artifacts might contradict it.
21:11
And so you've got to figure that out and you've got all these
21:13
different data points going. And especially I'm in this case
21:16
where there was a death and movement, you know, there was
21:19
the GPS data, the location data there, I did it again.
21:23
I shouldn't have called it the GPS that I, that's my, that's my
21:27
bad. Is the location data, the Apple
21:30
health with the steps and the the movement in the flights
21:33
knowledge see and call logs. There was some confliction on
21:37
call logs and then they got the the call logs from the the
21:40
cellular provider themselves. And that happens in another case
21:44
that we're going to talk about. You know, there's conflictions
21:46
and then all of your browser history review all of that stuff
21:50
together and you have to remember the jury hears
21:54
everything. And so you have to make sure
21:56
that whatever conclusion you are drawing on the stand, it has to
22:00
survive the whole picture that they're seeing and hearing and
22:04
it has to survive the cross examination.
22:09
You know, we heard some discrepancy in this trial with
22:14
an examiner stating one thing and then stating the other
22:18
thing. I think the point they were
22:19
trying to get to with the when it came to the Apple Health data
22:23
and then the arrival time of O'Keefe at 34 Fairview was that,
22:29
you know, with that, if you're paying attention to this
22:31
monotonic time, then this makes this time weird.
22:36
And then we don't know about the timing of these Apple Health
22:39
steps and the floors climbed. It was kind of like we're trying
22:43
to throw some doubt here onto the timing of all of this stuff.
22:48
But when you're throwing doubt onto other artifacts and other
22:51
times, you can't go and say this is the arrival time at 34
22:56
Fairview Rd., in my opinion. Because if you're saying this is
22:59
the time we are saying they arrived, then anything that
23:04
happens before or after that is negated to a certain extent.
23:07
Because what the problem was in this case was that there was the
23:11
Apple Health data was recording steps, distance and flights
23:16
before the arrival time at 34 Fairview Road.
23:20
And it should be noted again that both the defense and the
23:23
prosecution agreed on that timestamp of the arrival time.
23:26
So you can't say this is the arrival time and like like you
23:30
better take like, you know, what's up with these, this Apple
23:33
health data, you know? Sure, sure.
23:35
You've got to be like this is a time.
23:38
And because this is a time, this negates the Apple Health data.
23:41
You can't use it to be like discount all the other times,
23:44
you know. And so of course the question
23:46
becomes, well, why was there Apple Health data recorded?
23:49
Well, you know, sometimes it does record it when you're in a
23:53
car. They don't release the specs how
23:56
or why Apple Health data does what it does.
23:59
It's all been reverse engineered.
24:01
But I think one way to sort of solve this problem is to spend
24:05
some time timelining because if you timeline this out, then this
24:09
can help you identify some conflicting information and you
24:12
can figure out why is it conflicting?
24:15
Is it just like anomaly bumps in the road or timestamps off or
24:20
what is going on? Or maybe you can explain it, but
24:23
you need to be aware of it so you can kind of be more
24:26
proactive when you start being asked questions on the stand.
24:30
You don't want to be blindsided by them stating, oh, did you
24:32
know all this data is conflicting.
24:35
These timestamps don't make sense.
24:36
You don't want to be up there going like, no, no, I did not.
24:40
Right. And again, we, we, we emphasize
24:43
timelining and we emphasize correlating datas and timestamps
24:47
and we emphasize that it's not one piece of evidence that
24:52
solves the case, it is the totality of the evidence.
24:55
So yeah, definitely was needed in this case.
24:59
So cross referencing devices to identify deletions and
25:03
discrepancies. In Green's affidavit, he found
25:06
17 calls on O'keefe's phone to inform McCabe, but only one on
25:12
McCabe's phone. And this kind of cross device
25:15
comparison is how gaps become visible.
25:18
Don't examine devices in isolation when multiple devices
25:22
are available. Load all these pieces of
25:26
evidence into one case in your forensic tool and it will help
25:30
you timeline this out and identify any anomalies.
25:34
And as we have presented and we'll be presented in the
25:39
future, this becomes relevant in so many cases.
25:44
And you know when we start our next series, you'll see that
25:49
we're we are repeating ourselves over and over again about why
25:54
this cross reference of devices and the timelining and the
25:58
activity is so. Important.
26:00
Absolutely. And, you know, Speaking of cross
26:02
referencing information, another kind of recent ish change with
26:06
the iOS here in this case was the ability to directly search
26:11
in the search bar in Safari. And that those searches that are
26:15
conducted being logged in the com dot apple dot mobile safari
26:19
dot P list. And it only logs when they are
26:23
searching via that native search bar in Safari.
26:27
And so you have to remember if people go to google.com and they
26:30
start typing in their search terms into Google, those are not
26:33
going to be captured here. So if you see a search in that P
26:38
list, you need to know where it was entered from.
26:41
So you're going to say it was entered from that native search
26:43
bar. And that's, you know, can tell
26:46
you how that person was interacting with the phone.
26:49
But you shouldn't be like, this is the only place there are
26:51
searches. No, there could be search is
26:54
still in the regular history dot DB if they were doing searches
26:59
through Google. And then another thing to be
27:02
mindful of is when people are searching, you may need to
27:05
distinguish between what they are searching and typing versus
27:09
what is being suggested to them. And so again, couple of
27:13
different places to look for some of these Internet history
27:16
and searching artifacts. Again, the cross referencing
27:19
don't look at one artifact all by itself.
27:22
Yeah, and Speaking of absence of data in history dot DB plus
27:28
unbroken row IDs equals no user deletion.
27:33
Yeah, we'd love to check that. The the go into the database,
27:36
look for missing row IDs. That's it.
27:37
That's a nice easy check, right? It is.
27:40
Wiffin even showed that if the searches at 6:23 and 6:24 AM had
27:46
successfully loaded, they would appear in history dot DB.
27:49
They don't, and there are no gaps in the row IDs proving the
27:53
pages never fully loaded. So this is the database
27:57
equivalent of a paper trail. Yep.
28:00
And again, you might need to do some testing to feel comfortable
28:03
saying like when doesn't a search or something you're
28:07
trying to go to a URL visit, when doesn't it get logged in
28:10
the history DB? But you have to remember, like
28:13
there are some other artifacts from different databases,
28:16
different system files that were indicating, hey, this search was
28:19
going on. And so again, you got to figure
28:21
out what do all of those artifacts mean together?
28:24
Of course. Yep.
28:25
And then, I don't know, we didn't talk about it.
28:27
It wasn't in any of the digital forensics testimony.
28:31
But do you want to talk about something kind of silly from the
28:33
trial back? I want to say it's silly, but I
28:35
also want to say how important these these things can be
28:39
discussed. You know, it's, it doesn't have
28:41
to do with the digital evidence trail, but it definitely can
28:44
throw a kink in a trial. Yeah.
28:47
So Jennifer McCabe testified in this case and she had said at
28:51
some point, I believe it was when she was in grand jury that
28:54
some of these calls must have occurred before because she had
28:57
butt dialed. And then so when she was
28:59
testifying in this case in the first trial, they gave her a
29:02
really hard time on the stand about butt dialing.
29:06
But let's just talk about the phrase of butt dialing, right?
29:10
If you if you are mature like Becky and I are, you were around
29:16
when the the term butt dialing originated.
29:19
And this is because old phones, old cell phones used to be
29:24
different. There was what they called the
29:26
candy bar style cell phone and it was just like your phone with
29:30
like physical numbers and buttons to push.
29:33
And so sometimes, like, you would just like put it in your
29:37
back pocket or your purse or your front pocket, but you'd put
29:40
it like in your back pocket and you'd sit down.
29:42
And especially if you had a speed dial, a sign, then it
29:45
would start calling someone. And the person on the other end
29:48
would be like, hello, hello. And then maybe you'd hear
29:51
something coming from your butt or maybe you wouldn't.
29:54
And then, you know, it went from there.
29:57
And they're like, man, sorry, I butt dialed you.
29:59
And then if you've received that call where you just hear noise
30:02
in the background, you'd be like, Becky must have butt
30:03
dialed me again. That's right.
30:05
That's exactly right. And then you know that the flip
30:08
phones came along where it shut. So like, you know, there wasn't
30:12
so many buttons being pressed. But it's the terminology stuck.
30:18
Becky, what would you say that it means today if someone would
30:21
say butt dialed you or that was a butt dial?
30:24
It means that I'm carrying my phone and my phone opened up and
30:27
all of a sudden the last person I called, which is usually you
30:32
my, my finger touched it. No, it's not in my pocket.
30:36
It's not in my back pocket. It's not in my front pocket.
30:38
It's usually in my hand. Yeah, yeah, because you know
30:41
they. Just call it a butt dial, yeah?
30:42
Because it's, it just means it's an accidental thing that
30:46
occurred. And so, you know, terminology
30:48
changes over time. No, the butt dialing was
30:51
associated with accidental calls originally on cell phones when
30:55
they first started being used as mainstream.
30:57
And now it just kept in, and now it's just been adapted and it
31:00
still means a mistake. Yeah.
31:03
And bringing it back to digital evidence, it's still correlated
31:06
as whether it happened or didn't happen, right?
31:09
Dial happened, it still is recorded and now we got to
31:13
understand the context of that. Yeah, was it a, was it a, you
31:16
know, is that the one second thing you know, cuz you can see
31:19
like it was, was it answered or was it just called it not
31:22
answered because sometimes I'll accidentally hit the wrong
31:26
person and maybe it calls you super fast and I'm like, oh, you
31:29
might answer right away every once in a while and I'll be
31:31
like, oh, sorry, butt dialed you.
31:32
But like, yeah, it wasn't my butt.
31:34
It was my finger and I just hit the wrong thing.
31:37
Yeah, I mean, that happened to me a couple of times in the last
31:39
couple of weeks where someone has called me, I go to answer it
31:43
and it stops and I call them back and they're like, oh, I
31:46
butt dialed you when I was looking at my phone and I was
31:49
trying to text you back. Well, clearly is not a butt
31:53
dial, right? So yeah.
31:54
It's just an expression. So I mean, you might have to
31:57
explain certain stuff like that because you know, if in this
32:02
case, if McKay had testified before you, then somebody might
32:05
want to cross examine you on that and be like, well, what
32:08
does that really mean and why are they there and blah, blah,
32:11
blah. So you might need to be able to
32:12
give some reasonable expect, you know, explanations of that.
32:15
And another thing is just knowing the lingo because in
32:18
some cases more than others, the lingo of what people are saying
32:22
and what it means and how it's taken and construed really
32:24
matters. Sure.
32:25
Absolutely. The data alone doesn't convince
32:29
anyone. It's the story.
32:31
No matter how technically sound your findings are, if you can
32:34
translate them into plain English, you'll, you'll, you've
32:39
lost the jury before you've even started.
32:42
It's reported that while the digital forensic examiners were
32:45
testifying, A journalist watched from within the courtroom as the
32:49
jurors eyes glazed over and the jurors began to yawn.
32:54
Were they lost? Had they lost total interest?
32:57
Or was it simply case of the post lunch time yawns?
33:03
We don't know, but we have to keep in mind every complex
33:07
concept needs plain English analogy.
33:10
It's helpful when findings can be shared as a timeline rather
33:15
than as an artifact list, and every conclusion needs to land
33:19
in one sentence a juror can carry into the deliberation
33:23
room. Your testimony has to be
33:26
engaging. Clarity isn't dumbing down your
33:29
expertise. It's the highest expression of
33:32
it. But you know what?
33:34
It's going to take a lot of collaboration with your attorney
33:38
to get that story told the way it should be told.
33:41
Yeah, absolutely. So that is the end of our series
33:45
on the first Karen Reed trial. These are our lessons learned.
33:49
We hope you found some great information and key takeaways.
33:52
And, you know, loved these episodes.
33:54
And so we'd love for you to join us for our next episode.
33:58
And oh Becky, do you realize what episode number this is?
34:04
This is episode #52. Yes, this is number 52.
34:09
This means it's been 1 entire year of episodes and we have
34:15
finally reached the end of season 1.
34:20
Some people are like what are you going to switch to season 2?
34:23
And I was like, when should we switch to season 2?
34:25
I thought it was like a year. So here we are.
34:27
We did an episode every week week for a year.
34:31
That's the 52. And so we're at one whole year
34:35
of episodes and this is the last one of of season 1.
34:38
So we invite you to join us next week when we're going to go to
34:43
season 2, where we're going to kick it off by talking about
34:47
what else the podcast. Absolutely.
34:51
Right, right. And, and, and, and just to make
34:54
it very clear, it's a lot of work because we do our research,
34:58
we really dig in. We try to study the cases.
35:01
We're not here to point blame or point fingers or say we could do
35:05
it better. We're here to showcase the work
35:09
that digital forensic examiners do that do not get the attention
35:15
that they deserve. And so we just want to continued
35:20
these episodes and continue showcasing these cases.
35:24
A lot of forensic examiners are very humble.
35:28
They don't want to talk about all the great work that they've
35:32
done. But we feel it's important to
35:35
study these cases and bring out the artifacts, the testimony,
35:40
because if you can learn something down the line to where
35:45
you can be a better examiner, you can be a better testifier.
35:50
I don't know if that's a word, but you can testify.
35:53
You can testify better. Then that's what we want you to
35:58
learn from this podcast. Yeah, absolutely.
36:01
Like, I hope in your, you know, we're listening to these things
36:04
and you're enjoying it, but I hope like when some piece of
36:08
data comes up in your note next case, you'd be like, I remember
36:11
something about this and there was something tricky about it.
36:15
So I feel like I should not take this at face value.
36:17
Let me dig in and do a little bit more research before I just
36:20
run one way or the other with it.
36:21
That's exactly right. And like, maybe I should go and
36:25
test something. Maybe I should look at a
36:26
different version. Maybe I should see what has
36:29
changed from one version to another.
36:32
All these little pieces of information, they might not come
36:37
into play until a little while down the road. 6 months, a year,
36:41
2 years from now. And if you can, go back and
36:44
remember to. Maybe do a?
36:46
Little bit of more testing or looking at something else in a
36:50
in a different way. How a tool parse something
36:53
doesn't make any sense. Manually do it yourself.
36:57
These are the things that we want to bring to your attention.
36:59
Yep, it's been a great year. It has been a great year.
37:02
Join us next Thursday as we launch Season 2.
37:05
So and if you've enjoyed these episodes, we're asking you to
37:09
share it with a friend or a Co worker and just continue
37:12
listening to us. Give us some feedback.
37:14
Yep, let us know. So if you have a case that you
37:18
want us to do research and bring to to the podcast, we love the
37:22
stories that we don't know about.
37:24
And so, until next time and next season, stay safe, stay sharp,
37:30
and as always, keep parsing the truth, one bite at a time.
37:35
If you enjoyed this episode, make sure to follow us to get
37:38
notified the next time a new episode drops.
37:41
If you can do Morehead on over to parsingthetruth.com and
37:45
donate by clicking on the donate button.
37:48
Parsing the Truth is a nonprofit organization and we are raising
37:51
money to send a new digital Forensic Examiner to IASIS
37:55
training next year in Orlando. Thanks.
38:12
None.