Latest / Parsing the Truth: One Byte at a Time / Karen Read 1-7: Nick Guarino Testimony P1

Transcript

Karen Read 1-7: Nick Guarino Testimony P1 · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics,
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Parsing the Truth One Bite at a
0:53
Time is proud to welcome our first sponsor, ACE Forensics.
0:57
They are based near Chicago and they've been building systems
1:01
since 1983. ACE Forensics delivers high
1:05
performance digital forensics workstations, laptops and
1:08
servers to justice agencies across the United States and
1:12
around the world. They offer unmatched value and
1:15
the industry's only five year digital forensics warranty.
1:20
ACE Forensics build the systems digital forensics software
1:23
deserves. If you're procuring digital
1:26
forensics equipment, reach out to them for a competitive quote.
1:29
Now on to our episode. Welcome back to Parsing the
1:33
Truth, One bite at a time. I am Stacey Eldridge and with
1:37
me, as always, is Becky Passmore.
1:40
Hello. And we are the podcast where we
1:44
focus on digital evidence and the artifacts and the facts that
1:48
the digital examiners are discussing on the stand.
1:53
And we are continuing our coverage of the Karen Reed
1:56
trial, the first trial from 2024.
1:59
But Becky, what are we specifically going to get into
2:02
tonight? So.
2:03
Today we're going to walk through the trial testimony of
2:06
Trooper Nicholas Garino, a digital forensic examiner who
2:10
testified about his examination of several devices connected to
2:14
the Care and Read case. We're going to break his
2:17
testimony into two parts. This episode will include his
2:21
testimony under direct examination.
2:24
So the questions will be asked by the prosecution and Garino
2:27
takes the stand. And before diving into his
2:30
findings, the court first established his background, his
2:35
current position, his prior law enforcement experience and his
2:38
training in digital forensics. All pretty.
2:41
Standard stuff when you first hit the stand.
2:43
One thing to note in the recording that's available,
2:49
there is no indication that Greeno was admitted as an expert
2:54
witness. They didn't go through any of
2:55
that brouhaha that you have to do to bring him in.
3:00
Now, sometimes as a digital forensic examiner, you're going
3:04
to be admitted as an expert witness, and at other times,
3:07
depending on what you're testifying about, you might just
3:10
be a fact witness. So it seems like he's a fact
3:14
witness for a couple of things. One, we didn't hear that the
3:16
part where the prosecution asked for him to be admitted as an
3:20
expert witness, but as you go into the testimony, he's asked
3:24
for his opinion at a couple of different places and then the
3:28
defense objects, there's a sidebar, the question is
3:31
rephrased. And later again, you know, he's
3:33
asked for his opinion and the defense objects and it
3:36
sustained. So again, the question gets
3:38
rephrased. So to me this is indicating, and
3:42
of course this is without knowing exactly what the sidebar
3:44
was about, that he can't give his opinion because he's not an
3:49
expert witness. Only the experts can give
3:53
opinions. Becky, what do fact witnesses
3:55
do? They give facts, they rewrite
3:58
stuff into the record. So continuing on with Garino's
4:02
testimony, he stated he was provided with an affidavit
4:06
authored by the defense expert Richard Green, and he'll discuss
4:10
that affidavit more as his testimony is continuing on.
4:14
He also mentions that he reviewed Jessica Hyde's written
4:17
report that we discussed in a previous episode.
4:21
Garino also Garino also reached out to celebrate, and he spoke
4:26
with Ian Withen to assist in his analysis.
4:29
And yes, it's the same in Within, whose testimony we
4:33
discussed in last week's episode.
4:35
Now, one of the tools that Greenough discussed at the
4:38
beginning of his testimony was Burla, and this tool is used to
4:42
extract and analyze data from vehicles.
4:45
Specifically, it could download data from two different
4:48
components, the infotainment unit, so think the radio had
4:51
part of it and then the telematics module which is kind
4:56
of like a SIM card. But this is in the car.
4:58
And there is some more in depth discussion about this vehicle
5:03
evidence throughout the trial, but we're not planning to dig
5:07
into that at this time. That's not really our scope, our
5:10
specialty. So and we'll leave that to up to
5:12
the others who do that. But after he wrapped up his
5:15
discussion on that on Burla and the vehicle forensics that he
5:20
touched on, he also mentioned that he received a Dell laptop
5:24
and an HP Pavilion all in one computer that did belong to John
5:29
O'Keefe, and he examined that evidence.
5:31
And So what he did was created a forensic image and mentioning
5:36
we're just going to tell you that it's a bit for bit copy of
5:39
the drive and that this was done so the investigators could
5:43
examine the data without altering the original.
5:46
He loaded the forensic images into Magnet Axiom, which is a
5:50
forensic tool capable of analyzing data from both cell
5:54
phones and computers. When asked what he was looking
5:57
for on those computers, he focused primarily on whether
6:02
anyone had used them to log in and review or view Ring security
6:08
camera footage. He determined that neither
6:11
computer had been used for that purpose, and that the only
6:15
device that had access to O'keefe's Ring camera account
6:20
was actually O'keefe's cell phone.
6:22
There, Greeno explained that the process of what you have to do
6:26
when you're conducting a cell phone exam, he started the
6:29
beginning. When a phone is received, it
6:31
should be placed into airplane mode immediately to prevent any
6:35
remote wiping of the data. Alternatively, or doubly even,
6:40
it can go into a Faraday bag. And then that Faraday bag is
6:43
going to block all of those wireless signals, and then it's
6:46
going to be transported to his lab, and then there he's going
6:49
to plug it into a Faraday box. He did the extractions from both
6:54
O'keefe's phone and Reed's phones, and he did review the
7:00
phones belonging to Jennifer McCabe and Carrie Roberts and
7:04
the data that they contained. He did not recall performing the
7:07
full extractions for those two specific devices.
7:11
He also mentioned that he reviewed some screenshots of
7:14
some text messages from a phone that belonged to Brian Higgins,
7:18
and then he cross referenced those screenshots with the data
7:22
on Reed's and O'keefe's phones, finding them to be consistent.
7:26
For sure. So Garino received O'keefe's and
7:29
Karen Reed's phone on January the 29th at around six or seven
7:34
in the evening and those were received from Trooper Proctor at
7:38
the District Attorney's office. So O'keefe's phone was already
7:42
in airplane mode when you received it.
7:45
Reed's phone presented an early challenge.
7:48
It was not supported by the Labs tools at the time, and they did
7:53
not have the passcode for it. To get around that, Garino used
7:57
a specialized device called a Grey Key, which is a hardware
8:00
and software system capable of bypassing the ten attempt
8:04
passcode limit on both Apple and Android devices.
8:09
He was candid that he doesn't fully understand the technical
8:13
mechanics of how Grey Key works, just that it does, and he
8:18
successfully conducted the extraction of O'keefe's phone on
8:23
August 2022. And for people who aren't
8:27
digital forensic examiners, Gray Key is basically the same thing
8:31
as a celebrite. It's just a different version, a
8:34
different flavor. Both the Gray Key and the
8:36
Celebrite are capable of doing cell phone extractions.
8:40
Next up, Greedo was asked about how that data was extraction
8:44
extracted and then what happens after that.
8:47
And he replies that Gray Key uses its software to pull the
8:51
data out and then it puts it into an encrypted MB 5 or Shaw.
8:57
And then he kind of stumbles and says it's an encryption key.
9:02
And then he mentions if you change anything in the zip
9:04
folder, then it would change the encryption number to show that
9:08
something was tampered with. And as I mentioned, he kind of
9:12
stumbles through this. I think you can tell he's
9:14
flustered as he's saying that because he knows he's tripping
9:17
over his own words or something. But he gets to the important
9:21
part with the hashes and he mentions that you know if if
9:25
something changes then the hash is going to change.
9:29
And he mentions the words tampering.
9:31
But basically tampering is not the only option here, right?
9:35
Your hash will change if any bit one single bit has been changed.
9:38
So if you were copying something or downloading something,
9:42
sometimes a bit can be dropped and then when you rehash it then
9:46
the hashes aren't going to match if one tiny bit is missing.
9:49
So let's really just kind of dive into that a little bit.
9:53
What is hashing? Why do we use it?
9:55
As a digital forensic examiner, you should be familiar with MD5,
9:59
Shaw One, and Shaw 256 hashes. These hashes are specifically
10:05
cryptographic hash functions. These hash functions are
10:10
mathematical algorithms that converts the input, whether it's
10:14
a file, a forensic image, into a fixed string of characters.
10:19
The part that makes it cryptographic is that you can't
10:23
reverse the output to get back to the input, and two different
10:28
data sets will never produce the same hash value.
10:31
Yeah. So I think maybe like, is he
10:33
confusing like encryption with cryptographic and like
10:36
cryptography? Because I think cryptography is
10:39
like the study of encryption. Yes.
10:42
So I don't know if that's where he was stumbling around, but
10:45
anyway, so it's cryptographic because like you said, you can't
10:48
reverse engineer it to get back to the beginning.
10:50
And so here's my new favorite analogy for cryptographic
10:55
hashing. And it's because I want you to
10:57
think of it like a meat grinder, right?
10:59
You can put anything in the meat grinder, but you can never
11:03
reconstruct it from what comes out.
11:06
What do you think, Becky? Do you like?
11:07
It, I mean, you know, it does meet the analogy, but it is kind
11:11
of something in my opinion. To cover the whole breath.
11:14
But it's really focusing on what makes it cryptographic is the
11:17
fact that you can't, you can't go backwards.
11:19
So, you know, put that steak through the meat grinder and you
11:22
get your nice hamburger, but you're not going to be able to
11:25
put that hamburger back together to a steak.
11:27
That's right, that's exactly right.
11:29
So focusing on the oldest hat oldest hash value, the MD5.
11:35
MD5 hashes have been broken and are considered unreliable
11:40
because in the lab environment they've been able to create
11:43
collisions where two different data sets have generated the
11:48
same MD5 hash value. Might also be wondering why MD5
11:53
hashes are still even an option or available in forensic tools.
11:57
Namely, the justice system moves slowly and you might get a
12:00
really old case that only has MD5 hashes and so you will still
12:06
need to be able to verify them. So I don't think it will ever
12:09
completely disappear. Yeah, I don't know.
12:12
And that's kind of like our opinion why they're around.
12:14
I'm sure there's like a million other reasons why they're still.
12:17
Around but and the other thing is we got to remember it was in
12:20
a lab environment. It was a controlled situation,
12:23
right. So we can task something in a
12:26
lab environment to make make it be less reliable, yeah.
12:30
Well, and think about it like if we're going to put it into real
12:33
world use, if you really wanted to change something so the
12:40
hashes matched, but you wanted it to not be so different that
12:45
somebody wouldn't notice between the two, right?
12:47
Because you can't be like, oh, look, see the hashes match
12:51
between this picture of an apple and a picture of a banana.
12:53
And I'd be like, well, I don't care because obviously with my
12:55
eyeballs, I see a an apple in one and a banana in the other.
12:59
So it's got to be so, you know, right.
13:02
Can't forget that we all have eyeballs that we can use.
13:05
So, so, you know, it can't be changed so much that it doesn't
13:08
look the same. And so in the lab environment,
13:10
that's, that's what they're doing.
13:12
You know, they're shoving a, a square peg in a round hole.
13:15
But if, if it was a document, you know, what are they changing
13:19
so little of that we wouldn't notice, You know, I don't know.
13:22
That's sort of my, my ramblings on the hashes and, and the lab
13:25
stuff. My 2 cents, my $0.02.
13:29
But anyways, in terms of access control, they talk about it on
13:33
the stand. Greena noted that there's two
13:35
other examiners in his lab and they would have access to the
13:38
devices. But he continues that once the
13:41
extraction is completed, that physical device is typically
13:45
returned to the investigating officer or to the family.
13:49
Also testified that he did not observe any data being deleted
13:54
or removed from any of the devices that he worked with.
13:58
And one additional complication in this case was that Karen
14:03
Reed's phone originally could not be reviewed because of
14:07
attorney-client privileged information that was on there.
14:10
And so after they got her phone extraction done and those
14:14
materials had to be set aside for the Attorney General's
14:17
office. And and maybe that's not even
14:18
the right order, but so actually I'm unclear if who did the
14:22
extraction? Was it the Attorney general's
14:24
office who did the extraction and then did the filtering?
14:27
We'll call that a Tate team in the somebody else goes through
14:31
it before it can go to the other people who can actually look at
14:34
it. It's supposed to be that
14:35
independent, unbiased person filtering out the stuff that
14:38
you're not allowed to see. You can't see the
14:40
attorney-client privilege stuff. So along the way it gets
14:44
removed. So Karen Reed's phone data
14:46
didn't actually get returned to the investigators for
14:50
examination until the spring of 2023.
14:52
So fair amount of time had gone by.
14:54
Absolutely. So Garino shared the tools he
14:58
used in this case and like many other digital forensic
15:02
examiners, there was a multitude of tools that he used.
15:07
In this case it was Grey Key Windows 10 and Celebrite
15:12
Physical Analyzer as well as Magnet Axiom.
15:15
He was also asked why different tools are used.
15:18
Axiom does better at GPS. Celebrite gives native locations
15:22
but not that extra data, and he uses both to see everything that
15:30
he can see. Yeah.
15:31
So he's basically saying, you know, he can see something
15:33
better with one tool versus another tool.
15:36
I think his point is he's trying to see everything and then you
15:40
know, we've heard us in the past stress.
15:42
We use multiple tools also to validate your findings.
15:46
That's exactly right. So when it came to Karen Reed's
15:49
phone, Garino noted that he didn't see much GPS data on it
15:55
at all. Was asked what he could
15:58
determine about whether location services were turned on or off
16:02
by the user. He said he didn't see anything
16:04
that stood out to him, and he explained that when GPS points
16:09
are absent, location services were most likely turned off.
16:14
He confirmed that the device is capable of retaining that data,
16:19
but only if location services are actually enabled.
16:23
So the root of the question is, was GPS disabled on the phone or
16:29
was it just not working? They're trying to account for
16:34
the lack of location data, but if there's almost no location
16:38
data at all, it seems like it just might be disabled all the
16:43
time. Yeah.
16:44
But by contrast, when they talked about the GPS data
16:48
present on O'keefe's phone, Greeno said that there was quite
16:51
a bit of it, especially on the January, so the day in question.
16:56
And then he it was also asked if he had reviewed Jennifer
17:00
McCabe's phone and the affidavit submitted by the defense expert
17:05
Richard Green. And Greenough said that he went
17:07
through Green's report point by point to confirm or deny what
17:13
Green had written and determine if it was true or not.
17:17
Yeah, that's exactly right. So when asked what he found
17:20
regarding McCabe's phone in relation to Green's report and
17:25
over for a defense objection, the judge allowed him to answer.
17:29
Greeno's answer was that the report was mostly incorrect.
17:33
One item that stood out to him was Green's claim that a Google
17:37
search had been conducted at 2:27 in the morning.
17:41
Greeno visibly placed air quotes around the words Google search
17:48
as he answered, explaining that the file in question did not
17:53
come from the database. That would normally record
17:57
search activity. It came from a Session States
18:01
tab in Safari and it came from a wall file.
18:06
Again, the artifact that we're talking about is actually the
18:09
browser state dot DB file and it's associated wall file,
18:14
whereas your Internet history, whether you're browsing and
18:18
Googling, is stored in history. I thought it was kind of fun
18:21
when he was like Google search. So sometimes it's fun to fun to
18:25
watch him testify. But he continued on down and
18:30
explained the wall file. If you don't have browser state
18:33
dot DB and the term wall file burn into your brain.
18:37
Now, I don't know when you will, but we're going to say it a few
18:41
more times and maybe then it'll be burned into your brain
18:44
forever. Forever.
18:47
But anyways, he described this wall file as a staging area, a
18:51
dropping ground for where data is held before it's committed to
18:55
the main database. Once the wall file reaches a
18:58
certain threshold, the data is automatically cleared from it by
19:01
the device itself, not by a user.
19:04
And this directly contradicted Greens report which had
19:09
characterized the search record having been purposefully deleted
19:14
by the user. And that search record in
19:16
question is the house long to die in cold with the Hos?
19:22
Haven't said that in a while, right?
19:24
But so so I think as Greeno is testifying in this part, I think
19:30
he's being specific to Greens affidavit stating that the
19:33
Google search was deleted by the user.
19:36
I think there's two separate statements he's making here.
19:40
First he's saying that the wall file is a dropping ground for
19:44
data to be put before it's committed to the DB.
19:47
And then when the page limit is reached, then the data is going
19:50
to be committed to the wall and then the wall file is cleared.
19:55
So that's that's how that part works.
19:57
There's some other stuff to it, but then he is also mentioning
20:01
an important part. It is the device controlling and
20:05
manipulating the wall file. The user can't get to it.
20:09
It's under the hood, as I like to say, so the user can't get to
20:13
it and and this is just how databases work.
20:16
Now, what did the jury understand all of this to mean?
20:20
I don't know. Right, right.
20:21
So Carino also addressed Green's claims about deleted phone
20:26
calls, which again came from a wall file.
20:30
He notes that those call records were also found in two other
20:35
locations on the device, the Knowledge C database and the
20:39
Biomes database. Garino's broader assessment was
20:43
that most of what Green put in his report was either written
20:48
down incorrectly or interpreted incorrectly.
20:52
Next, Garino was specifically asked about the phone calls
20:55
Garino said were deleted from McCabe's phone.
20:58
He didn't mention the specific artifact, but it does come from
21:02
the database call history dot store data.
21:06
Green had stated that 18 calls were deleted from her phone on
21:10
the morning of the 29th. Greenough acknowledged that
21:14
those calls do appear to be marked as deleted and remembered
21:19
this is in celebrite and that they do come from the wall file.
21:23
But he pointed out that those same call records were also
21:27
found in two other locations on the device where iPhone user can
21:31
simply not go in and delete those files, and those areas are
21:36
all managed entirely by the operating system, making user
21:40
deletion, in his words, impossible.
21:43
So when asked again to explain what a wall file means, Grano
21:48
elaborated further. He described it as temporary
21:52
holding area that fills up as apps are being used.
21:57
The phone writes data there until the app is closed, the
22:02
phone is shut down, or the file reaches a certain number of
22:05
records, at which point it's automatically deleted.
22:08
That process can happen on on a first in first out basis or when
22:15
the file hits a certain size. He was clear that when Celebrite
22:19
marks those records as deleted, it doesn't mean the user deleted
22:24
them, it means they were removed from the wall file by the
22:28
operating system. Yeah.
22:29
So I think on the past couple of blocks, there's some stuff here
22:32
we should break down from his testimony.
22:34
Sure. First off, the presence of data
22:38
in other artifacts or in other locations like Knowledge C or
22:43
biomes doesn't necessarily indicate that a user did or did
22:48
not delete something. But typically we were looking
22:51
for the presence of of these other indicators of something
22:56
existing. You're doing it for cooperation
22:59
of an artifact existing, an incident, or for timing.
23:05
So for example, if you just deleted a text message before
23:09
you had a hand over your phone, you still might find trace
23:12
evidence somewhere else do like the notification coming into the
23:16
system. You as the examiner might not be
23:19
able to say that the user did or did not delete something.
23:23
You might only be able to say, I see the notification for the
23:29
call coming in, but I don't see the call in call history dot
23:33
store data anymore. I don't know why it's not there
23:37
anymore. Was it user deletion?
23:39
Was it too many calls and it simply got pushed out?
23:42
So you'd if you want to render your opinion on that, you'd have
23:45
to do some analysis and some testing to really opine
23:49
regarding why it's not in that call history log anymore in that
23:55
database. So let's focus again back on the
23:58
wall file information. Yeah, he's stating that
24:01
celebrate marks everything as deleted when it's coming from
24:06
the wall file. Yeah, that's what it sounds like
24:09
to me, right. So we are unsure if he really
24:11
means everything in the wall file is marked for deletion or
24:16
not, or if he's just reiterating what Celebrite does with this
24:21
wall data. We know for a fact that the wall
24:23
file has new data that needs to be committed to a database and
24:27
that and data that needs to be removed again.
24:31
This is why it's so important to know how your tools work.
24:35
What does a red X mean? Why does Celebrite say deleted?
24:40
These are things that Celebrite users need to use and understand
24:45
in their tools. Yep, 100%.
24:47
He also noted, as he continued, that the same call data appeared
24:52
in other databases on the phone. So specifically that Knowledge C
24:55
database and the biomes. He's saying that again.
24:58
And where that information shows up at is gonna depend on the
25:02
version of the iOS that the device is running.
25:06
Because, you know, new versions of the eye, and this is me
25:08
saying this, new versions of the iOS come out and stuff changes,
25:12
right? So some of these artifacts
25:14
overtime migrated from Knowledge C and now they're showing up in
25:19
the Biome. So sometimes this stuff moves
25:21
around. So that's why if you're
25:23
listening to testimony, you might hear different examiner
25:26
saying different stuff came from different artifacts.
25:28
It could be because of the iOS versions being different.
25:32
So that's something important to pay attention to.
25:35
But he was further asked about Green's claim that there was a
25:38
screenshot of Brian Albert's contact information and that it
25:43
had been deleted from McCabe's phone.
25:45
And Greenough said that there was a content still present for
25:48
Brian Albert still on the phone and that the contact had not
25:51
been deleted. And he surprised, maybe she just
25:54
deleted the screenshot. But me myself personally, I
25:59
would like to know if it was really a screenshot of that
26:02
contact taken by the user or if it was a snapshot taken by the
26:08
system of the screen. And this is done because we're
26:12
creating these snapshots for the app Switcher.
26:16
So that Switcher is, you know, when you're like, like it kind
26:19
of like it says when you're switching, switching between
26:21
your apps on the iPhone, you kind of get that nice visual
26:24
depiction of what's on the screen as you switch through
26:27
stuff. So it's got to take a picture of
26:29
it to show it to you so you can swipe through all the stuff.
26:31
So that's the magic happening in the background.
26:33
So I don't know if it was a snapshot versus a screenshot.
26:38
I don't know if it makes any difference if it's one or the
26:40
other. I mean, it does, right?
26:41
Because just in terms of who did what, right?
26:44
If it was a screenshot and she deleted it, then she deleted it,
26:48
and if it was a snapshot from the system, then that's just the
26:51
system doing its thing, right? Here's an interesting point.
26:55
Since the snapshots for the app Switcher are stored in the
27:00
database, they could have still been in a wall file.
27:03
And if Celebrite just marks everything from a wall file with
27:06
a red X indicating deleted, then maybe that's why they're saying
27:12
snapshot deleted. I don't know.
27:14
Food for thought. Just something I ran across and
27:18
thought I'd point out. Right, so Garino was then asked
27:21
what he did with the call log history from Mccabes phone.
27:26
He exported it to a PDF so he could so it could be reviewed.
27:31
The log contained a 11104 records going back to October
27:37
2020, covering both phone calls and FaceTime.
27:41
Of all those records, the only ones appearing as deleted were
27:45
from January 20th through the end of that day.
27:48
When asked where those records were stored, he referenced the
27:52
Call Store Sequel Lite database. Note the actual database naming
27:59
name being caught being. Yeah, he's, he's on the stand.
28:02
He's just trying to name off the top of his head.
28:04
It's hard to keep all those database names straight, but
28:07
we'll mention it here again for for those of you following along
28:10
if you want to try to figure some of the stuff stuff out on
28:12
your own. So Next up, he explained that
28:15
the call history dot store data database also has a
28:19
corresponding wall file. Basically, if it's database, it
28:22
has a wall file. That's just how it works.
28:25
So the data is written to the wall file automatically cleared
28:30
by the iOS, not by the user. So he's reiterating that again.
28:35
And then when asked directly for his opinion on whether those
28:39
records were deleted by the user, he said that he did not
28:43
believe that they were. So here he gets an opinion in
28:45
sometimes he can get an opinion in sometimes he I don't know
28:49
why, but anyways. So he did note 1 exception with
28:52
this though. He said that there was one in
28:55
the main call history dot store data database that potentially
28:59
could have been deleted by a user, but that same record
29:03
appeared in two other locations on the device.
29:05
And he also acknowledged that he fully doesn't understand why the
29:10
iOS stores data the way it does across these different
29:14
locations, right. It's a closed system.
29:16
It's proprietary Apples. They're not going to tell us why
29:18
they do anything so. Right, exactly.
29:21
That's an accurate statement. We wish they would.
29:24
Maybe I don't know, but anyways, I want to walk through this.
29:28
So Speaking of McCabe's phones, we know that we're talking about
29:34
these calls from the 29th and that these calls from the 29th
29:38
are logged in the wall file. Since there is a wall file and
29:43
there are records in it from before the police received the
29:47
phone. They didn't to get it on the
29:48
29th. That indicates to me that this
29:52
phone has been on since January 29th or before that.
29:56
And this also means that the phone must be in an AFU state,
30:01
the after first unlock state. And based on all this testimony,
30:05
we know that Celebrite seems to mark everything is deleted when
30:09
it's coming from a wall file. So to know for sure if it's a
30:14
deleted call or not, you would need to get that wall file
30:18
committed and look for the differences.
30:20
But even without taking that action, all of these clues seem
30:24
to indicate that these calls were not deleted, but just have
30:28
not been committed to the call history dot store data yet.
30:34
This is my opinion, I haven't seen the evidence but I'm just
30:37
walking down some things I would think about and analyze if I was
30:42
looking at this data. So from there the testimony
30:45
shifted to entering exhibits into the record.
30:49
In this part of his testimony, this is where Garino is simply
30:53
being a fact witness. He's just reading data into the
30:56
record. For the most part.
30:58
There's not really any discussion of technical
31:01
analysis. It's just getting the data
31:04
admitted. If you want, you can go back and
31:07
listen to the testimony and if you want all the details of what
31:10
was said in the text, etcetera. Garino introduced Exhibit 48,
31:17
which consists of Facebook Messenger chat logs between
31:21
Karen Reed and John O'Keefe. He explained how Facebook
31:25
Messenger chats work and then read in portions of the contents
31:30
into the record. The native text messages between
31:33
O'keefe's and Reed's phones were also introduced and admitted as
31:38
Exhibit 627 shown on the courtroom screen, with Garino
31:44
explaining how the messages were visually represented before
31:48
reading portions into the record.
31:51
Next up, there's John O'keefe's call log from the January 28th
31:56
at 9:19 AM through January 29th at six O 3:00 AM that was
32:02
introduced as an exhibit, as well as Karen Reed's call log
32:06
from January 29th where it began at 12:33 AM and went through 6 O
32:12
3:00 AM. And that captured calls between
32:16
Karen and John. And then there were also phone
32:19
calls and chat messages between Karen Reed and Laura Sullivan
32:24
that were introduced as a different exhibit.
32:26
And then finally, there was a phone call between Karen Reed
32:30
and Erin O'Keefe that was entered as Exhibit 630. 2 So
32:36
then Exhibits 51 and 52 covered phone calls and chats between
32:42
Karen Reed and Katie Tamarino. Exhibits 94 and 95 covered chats
32:50
and calls between Karen Reed and Jen McKay.
32:54
Reno's testimony was not completed that day.
32:56
It was continued to Day 28 of the trial, not day 27 as you may
33:02
have been expected. They did other things for the
33:05
trial on Day 27 without the jury present.
33:08
His testimony continues on Day 28 with Karen Reed's call logs
33:13
from January the 29th at 12:30, 3:00 AM through 3:19 PM, which
33:19
were entered as an exhibit along with call logs between Karen
33:25
Reed and Carrie Roberts as Exhibit 634, Chats between
33:31
O'Keefe and Chris Albert as Exhibit 635, a full chat report
33:38
covering all parties on January the 29th as Exhibit 636.
33:44
We're trying to give you the exhibit numbers as best as we
33:47
can, so you can go to review the data later if you wish.
33:51
We'll put a link in the show notes for the exhibits so.
33:55
Garino continued reading calls and chats into the record,
33:58
including reads and keeps, call logs from the 29th where he went
34:02
through and highlighted some specific call times and he was
34:07
asked to note which ones were answered and which ones weren't.
34:10
And then they went through the voicemails.
34:12
And one of the key takeaways from this review seems to be
34:16
that there was no indication that O'Keefe answered any of
34:20
Karen Reed's calls after 12:36 AM on January 29th.
34:25
There were also 8 voicemails left by Reed on O'keefe's phone.
34:30
Those were entered into an exhibit, I think they said
34:34
Exhibit 630 7, but also those were played for the jury in the
34:39
courtroom as well. Right, The data also showed that
34:43
Reed's phone auto connected to O'keefe's home Wi-Fi network at
34:50
12:36 AM, which this carries the implication that she was
34:54
physically near his residence at that time.
34:57
Following that, there were three calls from Reed's phone to a
35:02
contact listed as mom at 1:10 AM, full 40 AM and full 42 AM,
35:10
and only the third call was answered.
35:12
Garino also noted that the same phone number was listed for both
35:18
the mom and dad contacts on Reed's phone.
35:22
Now, wrapping up the direct examination, it's worth
35:25
summarizing the forensic tools and data that were covered in
35:29
the later part of this testimony.
35:31
And he mentions that to analyze O'keefe's iPhone, he used three
35:35
main forensic tools, Celebrite Magnet, Axiom and the LexisNexis
35:40
Track system. And he also used a GPS
35:44
application called Sartoppo. I think that's what he said.
35:49
And of course, I googled it and that seems to be what it is
35:52
because he mentioned that search teams commonly use this app, and
35:56
then he also used Google Earth and Google Maps to load in some
36:01
KMZ files, and KMZ files have GPS coordinates in them in order
36:06
to plot and visualize the routes.
36:09
Now all this testimony at this stage stayed at the application
36:13
and output level rather than getting into specific underlying
36:18
file names or database artifacts.
36:20
But there's some of this information we I want to share
36:23
with you. So on the health data side,
36:25
Greeno analyzed the iphone's built in health tracking and
36:29
noted that without an Apple Watch, the phone functions as a
36:33
basic pedometer, meaning movement of the phone itself
36:37
registers as steps even without actually walking.
36:41
The health data from O'keefe's phone showed 170 steps covering
36:46
326 feet between 12:11 and 12:21 AM, followed by 80 steps
36:54
covering 287 feet between 12:21 and 12:24 AM.
37:00
During that same window, the phone recorded ascending and
37:05
descending 3 floors, and between 12:31 and 12:32 AM it recorded
37:12
an additional 36 steps covering 85 feet.
37:16
So the I'm going to get on my soapbox here as I do with Apple
37:20
health data and ascending and descending of stairs.
37:23
The problem here is he's not telling us what database any of
37:26
this stuff is coming from. But depending on which database
37:30
you're talking about, one database only has ascending
37:35
steps. So like if you're a user on your
37:37
iPhone looking at steps climbed, that only ever shows flights
37:43
climbed because you have to remember this was built for like
37:46
exercise tracking. So if you're exercising, you're
37:49
counting steps going up, you don't care about steps going
37:53
down. So there are there is a place
37:56
where steps ascended is recording, but he doesn't say
37:58
where this is coming from. But to make a statement, he went
38:01
up or down. It's accurately recorded as to
38:05
which ones are up, which ones are down, it just depends where
38:09
you look. Greeno emphasized that the stair
38:13
climbing entry placed the phone near Maplecroft and Pine Cone
38:18
Road. And this is a location that's
38:20
more than 1/2 mile away from 34 Fairview Road.
38:25
And he's saying that the elevation changes in the terrain
38:28
in that area, but likely triggered the phone's stare
38:32
detection feature. Next, turning to the native GPS
38:36
location data and native location data, that is a
38:41
celebrate terminal term. That's something and they have
38:44
labeled in their app when you're using it.
38:48
Anyways, he notes that the sequence went like this.
38:54
At 12:12 AM, the phone was at Waterfall Bar and then at 12:19
38:59
AM it was near 138 Denim Street at Cedar Crest Rd.
39:05
One minute later, at 12:20 AM, Waze was activated and a search
39:11
for 34 Fairview Rd. was entered. Excuse me, just 34.
39:16
Fairview was entered, and that confirmed that O'Keefe had not
39:20
yet arrived at that address at that point because he was still
39:25
navigating there. And so by 12:24 AM, the phone
39:28
had arrived in the area of 34 Fairview Road, and from 1225 and
39:36
30 seconds in the AM onward, it remained stationary between 32
39:43
and 34 Fairview Rd. until 6:15 and 615 and 36 seconds AM.
39:52
The phone recorded a speed of .24 meters per second, which
39:58
Garino described as consistent with someone picking the phone
40:01
up. He also noted that the GPS
40:04
accuracy varied throughout those readings due to hilly terrain
40:11
and poor cell signal, with accuracy ranging from 52 feet to
40:15
200 feet across readings taken between. 1225 and 30 seconds and
40:21
12:25 and 36 seconds. In the AM.
40:26
And so the full route of O'Keefe Phone was traced as and right
40:32
into the record as departing Waterfall Bar, traveling down
40:36
Denham St. activating ways, proceeding down Maple Croft,
40:41
past Pine Cone Rd. taking a right onto Cedar Crest, passing
40:48
Fairview Rd. performing a three-point turn, and then
40:53
returning to the stop. And that's between 32 and 34
40:57
Fairview. Additionally, Reno and Trooper
41:00
Proctor visited 34 Fairview on May 8th, 2023, and they were
41:07
using GPS, yes, mapping tools and a tape measure to establish
41:11
that O'keefe's body was around 72 feet away in a straight line
41:16
from a door, from the door into that residence, not accounting
41:20
for the stairs. Now at this point, this marks
41:22
the end of his testimony during direct examination.
41:25
Now, Becky, thinking back on all the things we've just said here
41:30
and discuss anything you want to go back and look at it again
41:35
chat through or just topics for discussion you want to bring up
41:38
now as we're. Wrapping up, yeah, again, going
41:41
back to how witnesses are brought into trials, whether
41:46
they are reading records in which are creating exhibits that
41:51
are being admitted into the court because someone has to
41:55
read a record and for it to become an exhibit and to become
41:59
something that the jury uses in making their decisions.
42:02
So knowing that Carinos got a very big purpose here in reading
42:09
these records and creating these exhibits and not being called or
42:15
identified as an expert witness and being objected upon when he
42:19
tries to provide his opinion, these are all strategies and
42:23
techniques that are worked out in the courtroom.
42:26
Yeah, and you have to remember, he is the third digital forensic
42:29
examiner to testify in this case.
42:32
Jessica Hyde testified, Ian Winfen testified.
42:34
And they really got in, you know, nitty gritty into some of
42:38
the artifacts. So, like, how long do you have
42:40
to beat a dead horse with a wet noodle, right to get your point
42:44
across? At some point, the jury's just
42:45
going to zone out and be like, I don't need to hear about this
42:48
for the third time. But again, even in Greeno's
42:51
testimony, you hear him mentioning the wall file over
42:56
and over again. I mean, it's different wall
42:58
files because we're we're talking about different
43:01
artifacts. But there's a wall file
43:03
associated with every database every time, if it's still open,
43:07
if that app is still open when that extraction is conducted.
43:11
So, you know, I think they're trying to hit home, right?
43:14
Like, this is the purpose of the wall file.
43:17
And I think they want to hit home that they're disagreeing
43:21
where Green is saying all this stuff that's coming from the
43:24
wall file is deleted. So I think that's why they're
43:27
reiterating a lot about that. They're trying to make that very
43:31
clear to the jury. Yeah, for sure.
43:34
That's very clear. Like you said, very clear to the
43:36
jury. Yeah.
43:37
So I think that is about it. Hopefully you've enjoyed this
43:43
latest episode in our Karen Reed series.
43:46
Please, we we're asking another favor here if you would go and
43:50
review us wherever you're listening.
43:52
It really helps us expand our reach.
43:55
And we invite you to join us next week for Part 2 of Garino's
43:59
testimony, which includes our breakdown of his cross
44:03
examination and and the redirect.
44:06
That's right, until next time, stay safe, stay sharp, and as
44:09
always, keep parsing the truth one bite at a time.
44:14
If you enjoyed this episode, make sure to follow us to get
44:17
notified the next time a new episode drops.
44:20
If you can do Morehead on over to parsingthetruth.com and
44:24
donate by clicking on the donate button.
44:27
Parsing the Truth is a nonprofit organization and we are raising
44:30
money to send a new Digital Forensic Examiner to IASYS
44:34
training next year in Orlando. Thanks.