John O'Keefe/Karen Read Murder Trial: Day 29 Part 2

doctor uh you've listed several items that you reviewed and coming to your opinions and conclusions did you also review a toxicological report yes and a neurology report uh neuropathology report yes as well from the Comm yes the based on your review of all of those materials I don't want to know what your opinion or conclusion is yet but were you able to come to an opinion or conclusion concerning the injuries specifically to John O's arms yes or his right arm were there any documents in furtherance of your review from UC Davis yes did you review those well jaction sustained um with Course May display ex 19 okay do I want to show you a photograph and ask you very quickly have you seen this before yes is this one of a number of photographs that you reviewed F answer of your evaluation of this case yes it is I'd like to just focus your attention on this for just a quick second and ask you does this accurately reflect the wounds or injuries that you saw on John's right arm in coming to your opinions and conclusions yes it it reflects the injuries that I saw in photographs all right now based on your review review of all of the data that you've talked about all of the information that you were given and reviewed what is your opinion or conclusion about how these injuries were sustained I believe that these injuries were sustained by an animal um possibly a large dog because of the pattern of the injuries could you describe for the jurors please on what you base that opinion yes well there's may I use the sure okay thank you there's a number of patterns here there uh on the upper part of the arm uh there's parallel lines uh and those were inflicted by either uh teeth or claw marks so there's a number of patterns that uh could be teeth or CL Mark and so this is one set right here this is this is the one further down closer to the Elbow is another set of parallel marks again proba most likely from teeth marks and the reason I say that is in addition to the parallel marks uh up here down here there's also little punctate incomplete puncture Marks here U little round little round marks right there that were inflicted by the actual point of the tooth okay that was my question what relevance does that have to your determination that this was like to cause by yes and and I can explain in a moment the various kinds of wounds that animals can inflict but but uh going on with the picture first so then down right at the elbow there's another series different series of marks that again uh have linear abrasions up uh where the pointer is and then down below some punctate superficial round small abrasions again representing uh upper and lower teeth in my opinion and then there are some irregular wounds down just below the elbow and these are all by the way on the exterior surface or what we call the Post what doctors would call the posterior surface of the arm which is the part of the arm that would sustain defensive type wound so if someone were to protect themselves objection so sustain next question sure doctor if I can ask another question just to clear up what you said a little earlier about some wounds on close to the Elbow is it is it your opinion that both the top teeth and the bottom tee he could have created some or all of the injuries on that elbow area yes okay so in other words instead of the mouth going all the way around the arm it could have the top and bottom jaw could have situated itself on the this portion that we're seeing the the uh the posterior part of the arm yes um and in this case the animal did not get a good enough contact jaction move strike so I I'm going to strike that ask a different question have you seen contact wounds where animal a dog for instance gets a very solid purchase on the leg arm part of the body yes okay is that this or is this something else something else describe that well when an animal inflicts uh injuries the type of injury depends on in part on the actual type of contact and how much force is applied by that animal in addition to any relative movement between the animal and the victim in this case so um for instance in the law enforcement dog bites um many of jackon right so the nature is it notice is it what's one word may we approach okay yes thank you without getting into any specifics about police canines does this appeares the pattern of injuries that you see appear consistent with an animal or a large dog yes um does the number of injuries that you see here relegated to just the right arm is that also consistent with an animal or large dog yes it can be is the direction of the injuries or the consistency of the direction of the injuries parallel injuries is that also consistent with an animal or large dog attack yes based on everything that we discussed today doct is it your opinion based on a reasonable degree of medical certainty that these injuries were from an animal attack possibly large thought yes have yes that's I have okay may we approach okay you are unmuted good sure good afternoon man good afternoon sir now testify that you're certified in emergency medicine is that correct that is correct and you're not nor were you ever certified in forensic medicine is that correct that is correct apology correct and when was the last time that you worked at a Foreigner's office 1995 in in terms of doing autopsies yes now when was it that you first uh spoke to uh anyone from defense Council in regard to your coming in here and testifying uh today May 17th I am going to ask you to keep your voice up oh sorry thank you May 17th 2024 May 17th of this year is that right 2024 so about 6 weeks after the trial began I don't know when the trial began now as far as um who reached out to who I reached out to a district attorney that I worked with in uh with the LA car in his office and then somehow that person put you in touch with Mr Jackson is that right yes and was that also on May 17th 17th and 18th yes so I'm sorry 17th or the 18th which which one was it that you spoke with Mr Jackson I didn't speak to him you did not speak to not speaking not verbal there was some email communication or text communication you communicated with him but yes 1 or the 18th yes both I think both okay and uh when did you render this opinion as far as what you testified to here today shortly after he sent me the files now in regard to those files you testified in this cour a couple days ago correct I did and you were under oath at that point is that correct excuse me you were under oath at that point is that yes and when you were asked specifically what materials uh that you had reviewed um you included a number of items but you did not include anything about a Dr Sheridan affidavit anything about a UC Davis report or anything about any sort of bite history for K9 that lived or resided at 34 Fair Road correct that's correct because I hadn't reviewed them then and so since then two days ago now you've reviewed them correct yes I I became aware that those files existed yes you became aware of those files were they not sent to you previously no I think there were technical difficulties regarding me and the computer and and downloading from Dropbox and and so yeah so they they were I think they were sent to me but I think I didn't open them now with reference to these technical difficulties did you ever express any of those technical difficulties or hey I can't see the whole file or there's other things in here that are listed that I can't look at no I wasn't aware and so with regard to uh as far as your reaching out or contact uh in regard to this case how did that come about okay I saw an article I believe it was in the Boston Globe regarding this case and I didn't initially I didn't think anything of it then I saw uh an article that indicated that there was some I you anything about anything any article indicated saw an article in the Boston Globe about this case is that right yes and how did you come upon it you have a subscription to the Boston Globe I did at the time yes did at the time what time was this in May May of 2024 yes and how long had you had a subscription to the Boston Globe at the time that you saw this it was either a six-month subscription or a year I don't remember that was the first time that you had seen anything about that first time I paid attention to anything like that yes now again you had testified here just a couple of days ago and I asked you questions about this is that right yes it wasn't in your testimony just a couple of days ago that the subscription was actually for a year or 18 months no not six months a year so only one person can talk at a time so was that your testimony doctor no I don't believe so I believe that that I said it was a six month subcription or 12 month subcription then any event you saw something is that that's the first time that you recall seeing anything in the media about this case was in May of 2024 it was the first time that I recall reading anything about it correct now did you write a report in regard to your opinions that you've testified here today no can I asked you that a couple days ago as well yes okay so in the last couple days you've had time to review UC dav's report Dr Sheridan's affidavit and uh and any sort of dog by history but you haven't had a chance to write a report projection sustain to that one you haven't written a report correct that's correct why not I haven't been asked to write a report sir now did you ever look at anything related to Mr O's head injury I looked at sustained yes now doctor you testified that you had some familiarity with areas of forensic science or on some boards things of that nature is that correct yes and uh as a result of that or or any other work experience you familiar with a uh Nas report from 2008 not with that limited information no you're not aware of a report issued by the National Association of for science in 2008 which specifically has a section dealing with so I'm going to see you both at cbar again you're not familiar with that report specifically as it applies to forensic on onology so could you say that again Mr L what's the report the National Academy of Sciences 2008 report in relation to the section referring to forensic oology I'm not familiar with that specific report now you equally unfamiliar uh with uh the representation that that is not a from the nas report that that is not a reliable science as far as B Marks are concern there there are certain aspects of bite marks that have been deemed not reliable and that and that I believe has to do with saying that this particular person or animal uh inflicted this particular bite but that's that's very specific and that's what I'm aware of that that um recommendation you're not aware of any findings in in the nas report that led to questioning the value and scientific objectivity of such evidence for specifically identifying a bite mark to to an individual that might have inflicted the bite Mark um I think that's what that applies to okay I'm not asking again this is report are you familiar with it or are you not familiar I'm familiar with a summary or a abstract of a report that indicates that forensic or onology is not um very is is deemed not reliable when it comes to that particular narrow aspect of forensic onology and so you're not familiar with it also talking about sample data and collection analyses of these interpretation reporting of results you're not familiar with those areas of the NS report as well what specifically do you have a specific um question about that or first question was whether or not you're familiar with the report you indicated that you I did not read the report let the witness answer one question at a time one speaker at a time doctor can you answer that question I did not read that report okay now you had written some some articles that you were asked about in reference to uh dog bites can9 dog bites and the emergency department is that correct yes co-author that you published or authored or co-authored sometime in the late 1990s is that right correct and that instance you talk about law enforcement dogs and they bite a hole technique correct yes now part of the reason in writing that article had to do with sort of the applied forces and the unique spectrum of injuries uh from from those kind dog bites is that correct yes and that spectrum of injuries would include dep puncture wounds is that right they can yes severe Crush injuries is that right correct large tissue avulsions and lacerations is that right yes wounds necessitating surgical debridment is that right yes bony injuries ranging from cortical violations to displace fractures is that right yes neurovascular damage is that right yes and other wounds at high risk for infection correct correct correct but we also put a disclaimer in that article I'm not asking you about any disclaimer I'm asking about that's what the type of injuries that you were looking at is that correct yes but we saw a skewed population you skewed population in a study is that correct what we saw the worst of the worst no skew population in the study I'm sorry I don't understand the question did we skew did we skew no we reported on all the ones that presented to the emergency room for care however a lot of dog bites don't present to the emergency room and so from the different cases that you report on within that article are there any of those cases in which there is injuries to just one aspect of one part of the human body for the the victims of of dog attacks or dog bites in those cases there may have been that's a summary of of the 700 cases s more than 700 cases is it normal in any kind of animal attack for injuries to occur on just one side of one arm of the person that's being attacked clawed or bitten there are many people who are bitten or scratched I'm ask it's normal okay so Mr hold hold on Mr Jackson Mr L ask a question wait for the answer and then start a next question do not interrupt the witness I apologize I don't don't mean to interrupt but I'm asking for an answer responsive question so ask a question and ask it in a manner that you get a respons Dr Russell is it your testimony that it's normal in an animal attack for injuries to occur on just one side of one arm um and nothing else anywhere else on that person's bar it can be yes I'm not asking if it can be I'm asking is that normal I can't say sustain you have to ask the question differently so from your observations you looked at various photographs of Mr ke is that right I did did you observe any injuries on any other part of his body that you would attribute to an animal attack whether it law marks or fight marks or anything else no nothing on his left arm correct nothing that identified as a dog bite or scratch legs is that correct that's correct nothing on his torso is that correct that's correct now you say an animal attack possibly a large dog correct yes can you say what type of animal left these marks that you attribute to an animal attack not with 100% certainty no can you say where physically Mr keep was located when those uh the animal attack supposedly occur objection can you say that no okay can you say when Mr o'keef reportedly sustained these injuries from an animal T well to a certain degree yes I it was before death but not long enough to have a a big inflammatory reaction so yes so minutes to hours before death minutes to hours before death but at some point before death correct yes can you say anything about the breed of dog no you say anything about uh whether it occurred inside the house outside the house anything like that no as as far as uh men some of the different things that you reviewed over the course of of your testimony uh over the preparation of your testimony both prior to Tuesday and between Tuesday and today any of those things contain any forensic reports or uh phone examinations or anything else related to this case could you repeat that I didn't what kind of examination phone materials that you review whether it be prior sometime between May 17th and and Tuesday or anything that you review between Tuesday and today did any of those materials that you reviewed contain any sort of forensic reports or anything beyond the UC dat yes I saw a photograph so you saw photographs and to that point you never actually saw Mr O spot correct you just saw photograph that's true and with respect to the UC Davis report as far as K9 DNA are you aware that the results of that were that there was no K9 DNA on Mr O on swapping that were sent to the UC Davis left I'm going to allow it yes but there was clothing in between okay but the swapping came from the clothing with car and clothing in the same area as the injures correct okay do you know that or no I I couldn't tell if they came from the wound or the clothing I thought that they came from the clothing but you couldn't tell by reviewing the point whether or not swabbing came from CL or from Mr I know the clothing was sent to the laboratory you know the clothing was sent to what laboratory to the D DNA laboratory to ucis oh I don't know that no I'm sorry far aware that that came back as as far as negative for any K9 that's correct now as far as the injuries that you observed your testimony is that both the top teeth of of whatever animal this is and the bottom teeth of of whatever animal this is both made contact with only the top of Mr O's arm or the posterior of his arm they both sets of teeth made contact with certain of those wounds yes but not all of them but neither the top nor the bottom teeth made any contact That You observe um assuming your issue as far as an animal attack there's no evidence of any animal attack on the bottom of in ke right arm correct I'm not sure what you mean by bottom anterior anterior that's correct and nothing on the posterior or the anterior of his left arm that is correct and nothing on his legs that's correct nothing on his torso correct nothing on his head is that correct correct now as far as the marks that you did observe that you do attribute to an animal attack and you even say with certainty whether or not those marks you feel are are bite marks versus scratch marks do you have any idea which or which there may be a combination so is that a no well no I think that the ones that had the the linear abrasions above the pun the small round punctate abrasions I believe that those are bite marks from upper and lower teeth now you indicated that part of what you had reviewed uh was um a dog history for a dog from 34 fa Road Chloe is that right yes and there were a couple different instances of that dog U essentially getting in a fight with other dogs correct yes and at any point in time did you see anything in there as far as a dog going after a human in which there was no um no other dog present no and there were actually photographs contained within that material of uh dog bites from that dog from clo correct yes did any of those dog bites that you saw in those photographs look anything like what you observed in the photos that you saw Mr arm no but okay no so the answer is no you can get back up Mr Jackson but the answer to that question is no next question so is it your testimony that from reviewing what your review um that what you observe on Mr ke's arm is consistent with an animal attack to the exclusion of any other possibilities to a degree of reasonable medical certainty yes as far as any other sort of impact injuries or other manifestations of how those scratches got there you're saying nope had to be an animal T I've seen thousands of wounded what I'm asking is all right so Mr L I'm going to let the witness answer right I've seen thousands of people with injuries to their skin and from from blunt from sharp from um all different mechanisms those injuries did not look like blun force injuries so was your testimony that the injuries to his arm don't look anything like one force injuries that you've seen before you wouldn't characterize them as that that's correct and that's based on some photographs and some other materials that you began reviewing sometime May 17 2024 yes I me you doctor I need to make a diagnosis quickly when I see something and I'm trained to do that that's my that's my specialty you're being asked as an ER doctor to come to a quick conclusion and in this case no what you did anyway it's how I'm trained nothing further very your honor go ahead um concerning the forensic odontology report the nas report that um Mr L asked you about what is your understanding about the report as it pertains to identifying individuals who left a bite mark explain that for I I believe the report says that that is not reliable as as it once was thought to be like a fingerprint identifying a human being DNA identifying a person or a bik mark identifying a person n said not the B doesn't work that way that's correct has nothing to do with the pattern of injuries you've seen thousand times fromand correct correct you were asked several questions about the injuries that you saw and studied attended to dog highly trained dog highly trained canines uh police dogs correct yes very different than just a domestic dog that somebody might have his pet correct correct and the bite injuries are very very different as well aren't they that is correct you were asked whether or not you were aware based on UC Davis's report that there was no canine DNA found on on the squab that were sent to them correct yes are you also aware that there was Pig DNA I'm aware of that did that have any impact in your did you analyze that at all one way or the other not to any degree of scientific certainty no but you do know that do J pig sometimes correct objection suain you reviewed at least a report not a series of reports that indicate that that a particular dog party has an attack history correct yes you were asked specifically by Mr L whether or not the wounds in a dog attack on another dog attack where a human stuck a hand in the Middle look anything like these remember that question I remember a question like that and you said no but and then you were cut off remember that yes you finish that answer for yes so animals and dogs in particular can inflict a a wide variety of injuries on the skin from um from just individual puncture wounds to uh abrasions where there's a scratching of the skin to where there's actually a pulling away at uh and um pulling away of the skin from the underlying tissues your ripping effect and so there's a variety of wounds that that you know or pattern that one can see from an animal attack it depends a lot on the thickness of the skin the movement of the between the uh the victim and the animal and also the power of the animal and the training of the animal yes so in other words not all wounds inflicted by a particular animal are going to look exactly the same correct very Dynamic situation isn't it objection sustained doct having seen up to a thousand bite and claw marks on the the human body and based on your review of the entirety of the case File that you reviewed including nature and pattern and consistency of the injuries saw mr's right arm what is your opinion to a reasonable degree of scientific certain about the nature of those injuries objection sustain what is your ultimate conclusion and opinion about the injuries that you saw and that you reviewed we saw today objection sustain can you tell the jur at the end of the at the end of the day what is your opinion and conclusion about those injuries objection apprach than questions you are unmuted Mr L you had no more questions no yeah okay all right doctor you are all set okay thank you yes um sir if you pull that microphone as close to your face as you can so your voice will be kept up and I'd ask you to state your name and spell your last name sure uh Richard green that's G re n and where do you live sir I now reside in Coldwater Michigan what do you do I own and operate a company called United States forensics and what is United States forensics sure we're a digital investigation firm we have uh we're licensed in Florida and Michigan uh but we do uh cases across the country all right and again I'd ask you to keep your voice up because we have an air conditioner there and we have jurors behind me okay so my best as best you can um now you are president of that company sir I am in addition to managing the company what do you do on a day-to-day basis well I perform uh the majority of the investigations I specialize in computer cell phone Cloud uh Auto video U metadata media surveillance systems things of that nature do you work in conjunction with others certainly uh describe that please uh certainly well we do take cases from individuals I prefer to take cases from attorneys we've also worked with u numerous public defenders we've worked with a federal public defender uh we've worked with law enforcement uh so quite quite a variety of cele civil cases yeah civil and criminal um I would put it about 60% criminal 40% uh civil okay and with on the criminal side you've done both law enforcement and defense correct yeah most of the law enforcement ones though have been more geared towards civil is when they had a perhaps they were party to a suit and it was just improper for them to use their own experts so uh that's where we've provide assistance now how long have you been involved in the field of data forensics sure well my first case and testimony was 28 years ago I'm not even sure we call data forensics back then but uh that was 28 years ago and then about 16 years ago started the company United States forensics and been full-time in the industry since that point all right now You' mentioned that you'd actually testified for the first time 28 years ago that would have been 1996 if my mouth is correct that's correct you were qualified as an expert witness at that time yes sir um in order to have been qualified as an expert witness you must have had experience before that yeah specifically in computers we didn't do much with cell phones back then by about a decade or so in uh computer it networking um we actually built a line of computers uh a lot of repairs so I was pretty deep in into uh the computer it world at that point okay and you say you formed your company in 2006 correct and you work full-time parttime what's your schedule oh it's it's been full-time ever sense would you uh describe for the jury please your um educational background your training certifications Etc why don't we break it down into smaller s sure okay first with regard to your the training that you've received sure um so the uh that would have to do with Associates digital forensics uh well that would more be your education right you received an associates degree in digital forensics correct okay so why me start with education since you did okay well that that was that was uh part of the work and more or less the uh formal training to get that degree uh the the certifications which again this all kind of goes hand inand but uh the certification training would be the um uh CCE which is computer a certified computer examiner from the International Association criminal investigation Specialists I also have a certification as a computer crime related investigator uh cyber security uh as well as computer first responder uh the training aspect in over the last 18 years on really a daily basis i' when I've worked uh I've participated in um list done research into the newest developments in the uh computer forensics and really on usually a weekly basis we'll Target some uh training seminar uh I I found in this business even if you took us like six months off you would start to get behind in this business it changes that rapidly and uh you really need to do continual training okay and again your voice trilled off a little bit at the end so I'm sorry I'm sorry to keep reminding you but I just want to make sure every here um with regard to the you know your case load at USA uh forensics can you give the jury some idea of how many cases you handle on a yearly basis or historically yeah we uh average uh I say between 100 120 cases a year we probably get inquiries to about three times that amount okay and have you uh testified as an expert witness in the area of computer forensics uh since that 1996 first yeah we test about two dozen times in various state and federal courts okay uh and we say various States and courts that State Court federal court both both now directing your attention to September of 2022 were you contacted by somebody to become involved in this matter yes sir that was uh I believe it was Miss little what were you asked to do well there was uh three cell phones related to this case and to provide uh relevance uh with the data on those phones as related to the uh incident on January 29th 2022 okay and were you aware of the uh owners of those three phones certainly uh Karen Reed John o'keef and Jennifer McCabe now I'd like to ask you first if I can about John O'Keefe's Phone how did you um how did you receive the data from that phone if you remember yeah we uh received what's called an image file and that's a a forensic term that we use essentially it's a a copy of the data that's encapsulated into a single file in this case it was a zip file did you examine that data I did what were your goalss during your examination of John ke's phone what what were you looking for well initially what was supped was the location data we wanted to get an idea of uh when he had arrived and uh anything else that we could tell from that as far as location and when you say when you arrived do you remember the location that you were asked to learn when you 34 Fairview in Kon yes sir right were you able to determine as a result of your examination approximately when his phone arrived at 34 Fairview Road according to the location data yes sir and how did you do it sure well we uh I say we so that's proverbial we I extracted the uh the location cache data which is stored in the U on your phone and it's in the certain location we exported that out and then we use a tool called cellhawk and we imported in there so it can take LLY know thousands of data points and uh automate that process to specific GPS locations and just as importantly the range of accuracy that that location is reporting okay uh so uh according to the uh process that you uh underw what time did the location data indicate that John O's phone arrived at 343 on January 29th 20122 so the the first one right to the driveway was at 1224 and 28 seconds 1224 and 28 correct um now if I asked you to filter Journal keeps location data within an accuracy of 3T using cell Haw could you try to do that yes sir um in fact did you try to do it I did when last night who asked you to do that you did Sir me approach yes so I plac a doent before you could you familiarize yourself with that and look up at me when you're done all right recognize that I do what is it so this is a uh screenshot from the cellhawk program uh it has a u have a central uh box here that says database settings and this is where we apply a certain filter and what filter did you apply uh this was for the accuracy of um less than or equal to 3 ft with regard to what oh John uh ok's location data um is that a an exact uh is I'm sorry is the data on that document exactly what you received when you you know use the cellhawk program to uh to filter the data yes sir I no objection no objection oh I'm sorry I thought he said objection so you need to give it to Madam court reporter I'm all flustered sorry and if the witness could have that again thank you with permission like a publish okay okay so Mr what are we looking at okay so that is the screen shot from the cellhawk and what can you tell us about what you learn from that ex well I'll just use the pointer might help but you can see up in this part here where this is where we appli the filter for 3 feet or less that' be the accuracy and then it actually returns zero results meaning all of the data within there had a um an accuracy rating higher than that 3 foot it could be 5 meters or 10 meters but none of it was granular enough at a 3 foot or less accuracy level okay and if you put accuracy within say 500 what would you mind yeah you would see then uh a large number of circles each circle representing the uh the the the meters that the accuracy uh would be related to what was really important to understand though is you don't want to look at just the middle of the circle that accuracy indicates it could be anywhere in the circle so if you saw one and it encompassed two or three houses you you could only draw that inference of somewhere in that Circle so it's a it's kind of like how the hurricane they say don't don't just look at the cone right because it could be different than that um also the accuracy this is Apple's best guess what the accuracy is so it could actually be different than that it's uh Apple is using a number of services and they're giving back the the best estimation that they can for the accy okay so we talked about the location cach data and where it put John O's phone in terms of arriving at 34 Fairview but was there also Apple Health Data on joh ke's phone during that time certainly yes um is Apple Health Data generally accepted within the forensic scientific Community as being reliable well the the Apple Health Data is comes from something called health kit but it's integral to the iOS system so anyone that has an iPhone pricing Apple Health Data and what's uh is known to have extremely valuable data uh that the forensic tools uh work with and um present to us uh the degree of accuracy it depends on the type of data that's being pulled out on the artifacts for for example um steps are known to have an accuracy of around 98 uh percent uh on the actual steps being occurring so if if the Apple Health Data returns for instance uh steps of you know 20 steps within a certain time period 98% of the time right that's what Studies have shown all right may I approach the way witness R yes you want this back okay Mr another document before you do you recognize what that what that is uh yes I do this is a u uh this lists out uh Apple Health Data for um that was from John O phone on January 29th 2022 that came from the data that you received the image file of of John phone correct that is correct I would offer that your H Mr no objection commission I publish that you want okay specifically I'd like to start with page two Le two hey Mr Green are you wearing the right glasses to be able to see the same yeah I probably need B focals here I keep switching glasses but uh able to read what is on the screen if it's easier you can look on your document in front of you it's page two record to yeah you know I think I'm gonna have to uh to do that I can price still see good enough to do the laser one I'm sorry which record is this you're looking page two record number two okay yes I have that in front of me what does record number two show on page two of John's Apple Health Data sure so this is the uh number of meters it's listed as 87.7 and the uh time is listed between 12:21 and 10 seconds and and there's a a milliseconds after that but I'll I'll just round it off to the second if you don't mind uh so 1221 and 10 seconds to 1224 and 22 seconds okay um and you said that it showed 87 me travel during that time period correct and with regard to that same time period 1221 and 10 seconds and 1224 and 22 seconds please turn to page 5 and debates if you would zoom in on record number two I got that okay uh what does record number two reflect uh it's the same time period and the steps taken is recorded is 80 steps okay and you said same time period so again 12110 to 12422 correct correct all right now I'd like to direct your attention to page four record number one the post that you're ready Mr Green if you could tell the jury what that reflects sure so this indicates uh three sets of um uh floors that represents elevation change so it doesn't indicate to us up or down but three steps in the time period for that is 12224 to 12437 okay did you say 12214 to 1222 I'm sorry 12437 yeah yeah 12224 to 1247 37 um and with regard to all of this data the 80 steps and the three flights of stairs that you mentioned um is it possible to pinpoint where within the time frame that's given those steps or flights of stairs where Center to decenter no the most granular we can get is the time period and it doesn't um it doesn't signify as any more likely at the beginning of the time period then at the end of the time period Then at some time in the middle if you think logically like this is traveled that doesn't happen at a split moment it happens over Cur period of time so it's time is a factor in that equation and this is how the Apple records that data you got to you got to look at the time overall okay so you don't know if it's this St bunched up toward the beginning or to the end or more evenly spread up no I would not be able to tell you that now now we've discussed the Apple health I want to go back for a second to talk about the location data on the iPhone um does that data that you've already talked about in terms of the arrival time that it gave for John ke's phone at 34 Fairview um does that arrival time fall within or outside the range of 1221 and 10 or 12 1221 10 seconds and 1224 and 37 seconds well there is uh that certainly indicates an overlap but it the health that is ending after the arrival and we can now I'd like to discuss with you the concept of clocks used by appon and iPhone sure are you aware of the three different clocks that are used by iPhone apps I am what are they we have uh so three separate internal clocks you have a monotonic clock a baseband clock and a wall clock okay and is the wall clock also called a dis display clock yeah that that would be a also a common name for that and what is the significance of the existence of three clocks um regarding you know different times that may show up within these Recs sure well app developers uh can access uh Apple um U program library and they can call upon any of the clocks to use within their apps okay now in your investigation and examination of this case did you find examples on this phone of different clocks being used so in this particular case I had reprocessed the data with the newest version of the axium forensic program it's similar to CBR their competitors to CBR and it's we use both programs and this newest version had a feature in there where you can filter for the ways application and uh again and just following up and seeing how this function we filter for the ways application and for the first time we saw this monotonic uh timestamp being related to the way application I want to show you exhibit 640 I approach I placed exhibit 640 before you sir do you recognize what that is yes sir what is it so this is a screenshot from the magnet Action Program I was referring to it's the 8.1 actually Point looks like 4287 but up I'm sorry yeah so so it's the newest version of the program and we have a filtered for the way and it's giving us uh the time stamps associated with it okay with the court permission may I publish that there we go first of all is probably too small okay thank you I'll go off this one we go um with regard to what we are looking at there on that part of the screen uh what are we looking at Mr okay so this is listing details of this particular artifact and you can see that this is um bundled the com doway Ione that that's a standard um bundle type name where it always starts with com Dot and then the application reference what what does that mean it say it's highlighted on the screen com. w. iPhone what does that mean that we're in right now yeah well this is an artifa specifically related to the the Wes program Way app yes sir all right uh go on okay and we can see here uh our entry for the monotonic time the uh baseband time and the display time and what what did you notice about the relationship of the three of those certainly well most notice about that about this the mon tonic is running uh a little over 3 minutes ahead of the uh display so I think it's 3 minutes and 1 second give or take a little so you know in a lot of cases three minutes may not seem like much but in in this case uh this struck me as important to objection move to strike sustain next I apologize you can hand that back toam reporter sure and I'd like to go back to the Health Data Mr put that back up uh and this supp to be page two record number three and do you do you don't still have that in front of you do you actually I do you do I do page two record number three sir yes sir what does that show all right okay so this uh is a u another entry from Jano Kei uh data cell phone data and this records uh 25 met 25.46 meters occurring between 123156190 you have that dis as well Mr certainly so this is uh directly related to the um uh distance and this is uh recording 36 steps and it's the same time period 123156190 123 3156 a.m. it's actually 123156190 16507 a.m okay all right so now I'd like to switch if we can to Jennifer McCabe's phone and your analysis of that um during the course of your examination when you reviewed data from her phone um did you find a particular artifact of Interest yes I did what did you find we found a Google search that happened uh first of all the search was how long to die in cold and it happened at her before at 2:27 a.m. all right where was that search F sure so that the artifact on that it's called a safari suspended tabs artifact and there's a a database associated with that called the browser DB data base and in a company file which is by the same name but ends in W which stands for right ahead log and the right ahead log is where the data first gets written to and then that certain points that data then gets committed and written to the main database all right so that if I'm correct that browser state. dball file that's a temporary file right it's temporary by nature but it's not uh that's not it's integral it's part of the way the um SQ like functions so it's it's not like a throwaway file it's part of the way the whole system works and is it helpful to you when evaluating artifacts certainly yeah the uh just by nature of it we'll find a lot of the newest artifacts in that wall file now how do you determine the timing uh in terms of the time stamp on the browser state. DB wall file sure so the wall file has different uh rows and columns you can kind of think of it as an Excel spreadsheet and in this one particular uh column had a it was a time column that that' be the nature of the data going into it and this uh the heading on this particular one was last few time okay uh regarding that Google search for hos long I say Hos Hos long to cold found in the browser State DB wall file what was the date and time for that artifact sure so that's recorded in uh what's called appoa time and it's actually the number of second since uh January 1st 2001 so you end up with this large number and that gets converted to present to us uh something that's human readable and then you have to apply the asset for the local so once you do all those calculations we that's where we get that January 29th 2022 at 227 okay morning the specific you remember the number of seconds after I believe it it's 40 seconds 227 40 seconds okay and in what state did you find that artifact yeah so the uh the specific artifact or it comes from a record and the record number on this is um 4028 I believe and it was in a deleted State okay um now what would you normally expect to find along with the artifact Ser so you'd have the uh the date and time the URL which the way the URL presents itself we know that as a Google search but you also see a history of other places that tab has been and with this particular artifact did you learn the full internet history of websites related to that record no that wasn't possible we were only able to get though one website I I would say um I'm sorry go go ahead interrup well no so we we definitely got the one artifact uh the the the Google search and we have the time relat to it but we do not know everywhere else that tab uh had been what significance was there to you about the fact that the full internet history related to that record could not be recovered well I I want to do a a little deeper dive into that and so I use some various other database uh specific tools uh one uh was called belkasoft X which has an excellent database viewer in it Sanderson forensics which is known to specialize in this type of work and um uh artx I'm sorry artx you saved me yes artx which is a uh a program known in the community for research and how did you uh sort of cross cross reference the three of those together how' you use them yeah so all three of those tools along with axom and uh site which I did they do have a a lowlevel sqo viewer as well so I looked at the data with all five of those tools and I found it to be consistent amongst all the tools and in addition to using those tools what else did you do so I want to get a little more context one thing to with this artifact it is deleted and one thing about deleted data sometimes you get it all back sometimes you don't sometimes you get a fragment uh deleted data makes it very difficult to give you the whole picture of what's happening so in this particular case I want to see how what other artifacts were around this time as related to web history and particularly this uh uh browser um uh database file and and so um what you compare the 227 a.m search too in order to gain more information exactly I'm sorry what the information was so what what we found is that when we looked at a particular URL a particular website that was visited and then searched using that URL the browser State database entry is the last entry in in all of that so we could see searches um uh videos playing um there's an artifact called knowledge C that records the user's activity but the browser state is the very last entry on the the items that we observed and uh did you find other examples of that that you can speak to uh before this jerk uh yes I uh I believe we have one printed out there okay may I approach one yes okay I place the document for you sir if you could familiarize yourself with that and look up me when you're done I have it what is it okay so this is another uh screenshot from the axium program and uh it uh uh it is showing uh uh a search that we conducted for reigning men and then it takes that search and we have a couple um different items on there we set the date to begin in 1970 ending in 2100 in other words we only want to see artifacts that had dates associated with them and then uh we uh listed them from the newest statee to the oldest date and this particular one again it ends up with the Safari suspended tabs artifact being the very last in the series of days and times I like to go through that but first I'd offeror any objection no you're there you go and with the cour commission may yes okay okay okay so we have a number of columns here could you explain to the jury what's going on with that uh certainly so I I'm gonna I'm going to switch glasses uh back here forgive me do you need the light on sir are you open no I'm I'm fine thank you much I can I can certainly do this so we are uh looking at here web related history and also uh I have the filter turned on for application usage because there are some uh log files uh zort files that the iPhone keeps tracked up to record user interactions and that can give us a idea of the history as well and then as I mentioned we have it filtered so that's only showing dates uh that dates existed and we took the earliest possible date to a date way in the future and then it's listed and next to the date and time you'll see a little arrow and it's skinny at the top and big at the bottom that that tells you it's going from smallest uh earliest time to latest time and this particular view is showing us the um the L of that series because what's relevant and really important here is that the Safari suspended State tabs ends up being the last of the enturies related to that not one of the beginning of the entries related to that and what is the significance of the sa the Safari State being the last P what does that tell you yeah well uh so it tells us the Internet history happened before that and the the purpose of this tab on at least this particular iPhone with this very specific iOS version is to record uh the state of that tab when the user left that and the the the whole purpose purp of that is if you're on a safari you're on a website and say you had to take a phone call or answer a text message and you navigate away from the Safari app when you come back it remembers where you were and allows you to pick off from there um it also allows you to hit the tab button and see what other tabs you might have open and navigate to one of those tabs so as as I see the last I correct that the time is92 same day at 227 and 38 seconds that says on your I'm sorry I'm definitely getting a pair of iPhones I apologize here I feel a little silly uh yes yes on this particular one so that is um just moments before uh the um the Google search artifact the one that you previously talked about the D yes but all the other history of this particular artifact was before that time correct correct um so with regard to what that tells you about when the it reing men was either searched or accessed was that at after or before 227 and 38 seconds can you okay say one more time let me try put a different way the time stamp of 227 and 38 seconds on January 29th for that Safari suspended State tab that begin ring what did that tell you about the timing of when it's raining men was accessed by the user yeah well so the indications would be that that tab was brought up and then uh went away from to to do another tab so it can happen less than a second it doesn't take long to open up a tab and start a new tab can be done very quickly I'm not really phrasing this the right way to get what I want what I want is the timing of the interaction with by natural life user when did that happen certainly all the activity that we have is all prior to the recording of This that uh time stamp in the browser State all right now with regard to this particular example where the browser State DB is the last entry so the activity happened before was that unique on this phone or was were there many examples of this no I I found many examples of this exact behavior all right now given your your findings in researching these issues and how this user used this iPhone with this iOS do you have an opinion to a reasonable degree of scientific certainty as the time as to the timing of that search for hosong to dying cold objection sustained do you have an opinion to a reasonable degree of scientific certainty as to when Hong To Die In Cold was searched objection sustained I can see you at thank you you are unmuted do you have an opinion as to the timing of that first search for hosong to Giant cold yes I do what is that opinion that that would have happened at or before January 29th 2022 at 22740 a.m. in the morning and what is the basis for your opinion Again by how this particular phone operates with that exact operating system and comparing to other data on that phone and the way it presented it out itself is all consistent with that search happening at or before that time um and what opinions or conclusions did you reach regarding how if any how the 227 a.m. search was deleted well we we uh know that that's in a uh deleted State and importantly on that phone is we I I I using the proverbial week I found of a lot of other that we been used or deleted artifacts between the midnight and the early mornings on January 29th 2022 okay um are you aware of any internal mechanisms that could have caused that deletion no not not in this uh particular case I know no mechanism that we have done that and you mentioned dele other deletions on the phone I want to show you what has been marked if I may approach mmm for identification do you recognize what I placed before you sir yes sir what is it okay this is from sellbrite is a program again like the axum that process this data and uh this is a u uh this lists out a uh 623 this lists out a deleted call record okay um are you able to see from that record to whom the call was placed yeah well we have the number and I won't necessarily read it out loud here but uh through searching and this is from uh the phone of um Jeffer mccave but through searching for that the number I was able to see that it went to um you want to say the name sure yeah U Uncle Brian a I would offer that in your H same objection as before your H as when this was may we approach okay you will technically have it in evidence twice okay thank you may I approach again your yes there one final document before you if you can identify that for the jury please uh yes this is another report generated out of SBR it's based on uh Miss McCabe's um cell phone data and uh this lists out the call log with a number of um deleted items and a number of live items that if I get to see F I think it's already in evidence as well but actually it's confirm it's not it's not yet in evidence we look at the exhibits that were specified so thank you um if you hand that to have okay with regard to that exhibit Mr GRE what what did you find that was unusual with anything objection sustained ask it differ yes what did you find of note uh certainly what was the time frame of the um deleted records now uh I'll just talk about this particular report here I it starts at 533479 15 seconds again a.m. and then the normal calls what we call live data then begins at 8:59 and 34 seconds and goes on throughout the day with no more with no additional delions and am I right those are all that's the call those are all phone calls correct yeah this is the call off and what was the difference between the calls that were at 859 and after on January 29th 2022 and and the calls that were before at or before 850 a.m. on January 29th 2022 yeah well it's the state they were found in uh deleted versus live data I'm sorry deleted data at the earlier time and live data after the uh the 85934 what what percentage of phone calls were found deleted on Jennifer MC's phone prior to 8:50 a.m. on January 29th I all right I have to see you take this down for a minute please I have to see Council so Mr I'm not sure if that question is clear if you understood it if it's not please let me know but I had asked you um from the first recorded call there was deleted until 8:50 a.m. or so what percentage of calls were deleted on phone within that time period yeah so we found no live data so 100% of them we have been deleted now are you aware of the term spontaneous dele uh no sir uh I I know what the individual words mean but in in relation to digital forensics I'm not familiar with that term and do you have an opinion as to how those calls would have been deleted from that phone those would have been used are deleted I moment sure for the question than okay [Music] good afternoon sir good afternoon sir do you know who uh Miss Jessica Hyde is I do you aware that she uh wrote a report in relation to this case yes specifically in regard to the Google searches from Mr CES that you were just talking about yes sir it was very specific about that search and have you had a chance to revie that report I have you also know who a Ian within is certainly yes and are you aware that he wrote several reports submitted several items in relation to again the exact topic that you're testifying about in relation to Google searches on Cas yes sir I understand that and have you had a chance to review those materials as well yes sir you understand that they both disagree with what your opinion is in relation to those C I absolutely understand that sir now this as far as your qualifications and and certifications go I'm just having a difficult time from the certifications that you have at what point were you uh or what if any certifications do you have with reference to CBR as a tool as far as your use and interpretation of data from CBR uh certainly so my certifications are much more broad they have to do with lot of fundamentals and and how we conduct the investigations and what uh tools we should know and when we need know we need to do more work and such like that uh sellbrite um I do not have any specific celbrate certifications they offer many of them uh however I part I have participated in um God I can't even count um hundreds of their training events that they offer uh both uh celbrate axium belkasoft they all provide the community with fantastic support as far as that and although certainly a class can be very good but you really need to to stay up to speed you you got to participate in the the most recent uh understanding being put out there even in the changes of their tools will change from one version to another and so to the point as far as you you have no certifications in regard to celebrs as a tool and how to use it those kind of things that's correct sir and in this specific instance at any point did you reach out to cell rights uh to go over sort of your findings or your opinions in relation to the search I didn't and uh if anyone with from uh as close as I can remember I know it was Leo and I believe it was Santos and do you know what part of CBR they work in or what they do well he was in the the technical support and uh contacted him uh he had informed me that they had elevated this up the um to some higher level technical uh support when they came back uh his uh comments to me if you want to hear him uh was at this okay comments but at some point technical support is that correct absolutely and they indicated that they would refer you to uh actually Mr wh's team no sir they did not so you weren't told that you were referred to Mr whff team and you weren't contacted by anyone from Mr whff steam no um uh and I forget the exact date couple weeks ago maybe a month ago uh out of blue I got an email from M wiffin saying um and I can't I don't I don't want to misquote them but certainly I got Emil any conversation you had when I'm asking and I'm asking about a time period more back in 2022 I'm sorry I couldn't quite hear you back in 2022 did you reach out to CBR in relation to the search and your opinions related too yes sir and at that point was at the point that you spoke to someone from technical sport yes sir and uh at that point did someone from technical support actually refer you or tell you that they were referring you to Mr whiffin team no sir I had absolutely no idea about that so no one from Mr team no one from Mr whiffin team reached out to you and then you just never called them back that didn't happen now that I'm aware now you were asked to look at uh couple different phones and I'm assuming by Council for the defendant correct can you say that once again I'm sorry you were asked to look at three different phones is what your testimony was and I'm assuming that was by some councel for the defendant correct no one else asked you to look at these phones corre oh correct yes it was from the defense ask to yes and so the phones that you were asked to look at were Mr O's phone the defendant's phone and M M's phone correct correct now as far as car Roberts's phone would you ever asked to look at that no and with respect to the defendant's phone was there any GPS location information or data that you observed in her phone so we had an indication that location had been using there with something called Apple map tiles and those probably when you use the Apple map app that it uh in order for it to work it will create these little tiles there little pieces of pictures and they get stitched together to give you the view that you see on your phone now for that had to been working we know location data had to be working this particular location data the location data cach is known to only be present on the phone for a couple weeks now what I I don't know Mr if I'm going too far just please stop me um what I don't know what measures were taken to preserve that data whether it was put um in airplane mode whether the location services were turned off whether it was put in a fair day bag and and quite frankly Mr L I don't know if they did all that if the location data would have remained or not I've never tested that but all indications it would have had location data um on the day that it it was seas because we we see the Apple map to but when I got the full extraction there was no location data there now I did observe no there was no has location data on the defend correct from What You observe and again if I'm there was I did find deleted location data from April of 2022 okay now with respect to the defendant phone did you also find deleted web history data from the afternoon of January 29th 2022 no I'm sorry I didn't observe that didn't observe it or didn't look for it uh you know I really don't have a recollection if I specifically look for C data I don't believe I did I don't know if I would had to have a cause to now with reference to your asking question about um location accuracy within 3 fet you did some sort of U thing last night on cellhawk using that tool is that correct certainly and you were asked to do that after Cho testified yesterday is that correct I testified yesterday and so with relation to you creating sort of that document and that's now been marked as an exhibit was that something that Mr Genetti asked you to do in relation to Trio's testimony yesterday well in all fair do you need to ask Mr Genetti U I um I could make an assumption here I I I mean uh if I don't quite I'm not trying not to answer you uh you know but I was asked by Mr unit to perform that search so Mr L please be cous that yes so Mr Green with respect uh to that free accuracy are you aware that what tro was testifying to in regard to that had absolutely nothing to do with phone applications or anything to do with data from phone or cellhawk or tool or anything like that now I I don't know the full extent to what Mr Green we been testifying to and so you're not aware that this testimony was actually in regard to reviewing a cruiser camera video from the K police department and photographs OFW Mr O was and then mapping that using GPS latitude longitude based on that within 3T a the objection sustained ask it you aware of any of whato testifies to yesterday uh what you're mentioning uh I I may vaguely be remembered and again I'm not trying to not answer your question uh exactly uh my conversation with Mr gened K is is the is three for when it comes to GPS data uh you can you tell 3T from GPS data and no it's not known to be that reliable particularly Apple location services how that applies to um the the trooper testimony uh you know I can't say with specificity I'm happy to Pine on location data though there's no question but that's thank you now sir with reference to uh Safari and deleted tabs um isn't it true that there's no way for a user to delete a tab only to close it you agree with that yeah well when you when you close a tab all right you're taking it out of the active State and it's going to an inactive state that some people could call deleted now the uh Safari history allows you to go in and delete history by uh certain date Rangers but you can also go into a specific websites that you visited and delete those now now you if you want me to continue the wall file itself you can't open up a wall file and say I'm want to delete that record but functioning the phone to the user interfaces will have an effect of deleting data within that wall file is it also true that celite uses that red X to annotate that the record is no longer active and has been recovered uh then make com upon the examiner uh being you in this instance to determine if it was actually doing correct yes sir thank you for asking it's yes that's all I'm ask okay all right and you say it in your AFF in yourest that you used the Sanderson SQ or SQL light forensic explore to examine the Safari Taps uh DB associated with the with the wall file log is that correct yes sir now in your analysis using that Sanderson forensic explore was there indication that house long to dying C was found in the wall file yes sir now with regard to that did you independently verify the cause of that time stamp that you observed there yes sir now is it your interpretation that the time stamp means the search appeared at that time solely based on the naming of the field in the database no sir now can a wall file contain items that are so new that they're not yet committed to the database yes sir that's the purpose of it so the wall file holds the newest information so merge of the database including additions deletions changes all of those items correct that is correct now according to your affid the device was in active use between 223 a.m and 231 a.m. just to be clear I'm talking about Mr cage device correct correct and uh what other searches did you see at that time and where were they perform I I I'm sorry can you repeat that I couldn't quite heares Did You observe in that time frame and where were they perform well there there were a number of U websites uh including um the uh rainy men exhibit that we did there was um ozone um basketball there hammont Smith I can tell you that those similarly the last entry with those there is the browser State DB file it's not at the beginning it's not at the end and I have a couple thoughts on why that may be in regards to miss Hyde and Miss whiff and I'm happy to share those with you I'm not asking you anything about that sir asking is is it possible for a change request in the wall to a sqlite database uh pertaining to one particular field leaving the other field as what they were previously I I I and I want to answer your question as well as I can so can you repeat that one more time is it possible um is it possible for a change request in the wall to a sqlite database pertaining to one particular field leaving the other field as what they were previously um I I'm having a little trouble answering this so um if if I'm understanding correctly the when wall file gets written to the database and could that have made the the change ending with this deleted record is is that the question I I'm I'm sorry I want to answer you I'm just a little loss on how you're the question sorry do you not understand the question why don't you move on Mr is it possible that the URL field which has the website name was updated uh to the newest search while the time stamp rained the original search is that possible no not the way on this particular phone and this particular iOS and also way the user interacted with it that it would have been at the 227 or before the way this very specific iOS was happening that is consistent with all the other ones that I observed out there on the phone related to specific web uh searches and activity is it possible that the search for house long and die in the cold uh at 6:24 a.m. was the most recent search completed in the tab I well not in that tab but I certainly agree with you that there was a second search done at around that time now is it also possible that the search that you Asser took place at 227 and 40 seconds in the morning is the same as the search that took place at 62451 a.m. for that same search yeah that's inconsistent with the the actual data on on this actual phone with this precise iOS version Safari with the the the string as far as um the sm. apple.com included is it um you recall that search as far as being a suggestion from Apple from the IOS as far as the the search with how long to digest food okay I didn't hear your whole question but I heard the last part about how long to digest food so I can I'll Pine on that so my feeling on that is when the um how long the D Co was put in that that was most likely a apple suggestion and i' I've done some testing now the time period I'm doing my testing you know is after the fact that this would have actually occurred but as I tested that on a live phone and using a Google search I could see that that uh how long to digest food would come up I also notice a the specific phrase uh how long does it take to die from hypothermia so as you do this Google Search you try to repeat what's been done those are two suggestions that actually came up and so that was something that was a suggestion and not something that was actually searched cor yeah no I and I know that's different from my f from about a year and a half ago in all fairness but that's entirely one person Mr L I'm sorry one person at a time okay so yeah In fairness I want to give you the my best knowledge as I understand it saying here today including after my review of Mr whiffin and Miss heid's report uh so I want to do everything I can to shine as much light and clear on this as possible so as I repeated know since that time and did the search I would notice that that is one of the things would come up and it would have a little picture of like a dinner plate or something like that and and there was actually a similar if not the same picture found in the um artifacts of that phone and so just to conclude that's that's not what you said in your affidavit that was actually filed under pains and penalties of perjury with this court correct yes and on that day that is what my true improper belief was okay it since further testing I have found that I I now believe that that was probably an automatic uh one and if I've uh caused you any distress I apologize caus me any distress what I'm asking sir is that you that's what you filed because that's what you thought at the time correct yes sir and subsequently you've done further testing and that shown that you were wrong correct that is correct now according uh to your affid there was a search for how long to dig food at 62349 a.m. that precedes the search for how long to die and the the misspelling here would be uh the key CL KD at 62351 is that correct yes sir now is it possible that the how long to digest food was a predictive suggestion from Apple rather than a search entered by the user is that also correct I I don't know u i I don't know the answer to that uh I believe that it was if it had picked up a earlier search from 227 of how's long to die in the cold and then you went to retype it in it may have then tried to give you something similar at the 623 and 624 timelines hopefully that answers your question so steps going to Mr O's Health datas um steps doesn't necessarily mean that someone is physically taking steps correct uh again the uh research has done for this is steps tend to be a very accurate uh artifact so steps cannot also be coincided with say movement in a car or other sort of movement of the phone as far as the health is concerned sure well I I I did U she quite some time ago do some testing with an actual iPhone 11 the S make model and took a drive and tried to see if it registered steps it did not I sat in a chair and tried to duplicate how I thought I would walk to see if it recorded steps it did not I took the phone from the floor to the ceiling to see if it would record uh flight of stairs it did not uh the only uh with that um iPhone 11 say make a model that I got it was very consistent with me actually uh doing and doing walking steps and that was whether I had it in my shirt pocket my pants pocket or clipped onto my belt that's your testimony that is my testimony yes sir now you familiar with GPS native locations yes sir and GPS native locations takes uh its data as far as uh defining latitude and longitude from a number of different sources correct well it uh true GPS okay it's going to take it from the GPS Network what you may be thinking of is assisted GPS which the iPhone uses and that assisted GPS will try to it kind of does a cross sourcing so it'll look at cell towers uh what's in range as far as like Wi-Fi and um a number other devices to try to get you an enhan GPS location and um and give you the best data possible so it takes GPS native locations within an Apple iOS device takes from four different sources isn't that correct uh it tries to get from a variety of sources like I just mentioned not all would be available now with regard did you look at any GPS native location data with regard to Mr O's phone yes sir and would you agree then that the GPS native locations didn't report any movement of that phone after 12:25 a.m. um 12:25 you know I would have to look at the uh exhibit to see what the time of that last entry was I I don't want to misstate something to you sir now you were asked about sort of the elevation change in three floors ascending descending and saying that you couldn't pinpoint a time period or within that 1221 to 1224 time period from the Health Data is that correct correct happen somewhere within that time could you pinpoint more specifically if you look at the GPS native location data uh the no well we're talking Apple health and GPS location so I'm you said you couldn't do I'm sorry which one you asking about pleas please what I'm asking is you said you couldn't pinpoint it within the GPS Health Data what I'm asking is if you had looked at the GPS native location data could you give a more specific pinpoint as to where mr's phone was I'm going to all all outbe okay you are [Music] unmuted now to be clear sir you would indicated earlier in your testimony that uh the elevation change from 1221 1224 you could not pinpoint uh where in that time period or specifically uh where in that time period the elevation change curve correct that's correct it's a Time range yes sir but what I'm asking is had you looked at that in the GPS native location data would you have been able to more accurately or specifically pinpoint when that occurred okay so the location are you looking for yes or no I'm sorry yes or no um there there was yes there was location data within that time period okay and are you aware that Mr O phone from the GPS native location data was actually a half mile away from 34 Fairview Road at the time that it made those recordings in the GPS Apple Health right yes I understand he was using ways and it had made that recording I I understand that that's why the the finding that three minute and 1 second offset brings into serious doubt if that time was accurate and when you apply that to the the uh location offset then the Apple Health Data and the GPS all aligns now I I I cannot I have not decoded ways and and found out what functions they were calling and all that and I I don't mean to indicate that I have by I mean that the latest version of axom is bringing that up as an artifact and it time stamp related to ways and in the case of here where minutes are important I I thought it you know proper that I bring this to uh the attention of of the case as a as a possible explanation as a possible explanation as a possible explanation sir yes the three different clocks that you were talking about are you aware that those are actually Associated to power usage and not applications right that power usage was directly related to the way application so it's your testimony that those three clocks apply to the times and WS is that your testimony I I'm saying that the uh the time stamps were directly related to ways it was reported by axum when you appli the filter and say show me every are the artifacts way these were artifacts that came up related to the ways bundle so I guess you need to give it the weight it deserves like like I said I've I've not decoded uh ways that's not something that has been done but I think we need to consider the the three-minute offset as it applies to giving significance of the Apple Health Data and the wayist GPS now turning to M Mone again as far as the search uh what you indicated as last view time are you aware that that is actually uh related to a time that was actually focused on the screen as opposed to uh your interpretation of it uh I I'm aware that from that that appears to be the last date time and date it was focused and when it was no longer was focused that's when the time stamp was written that's what's consistent with the other data on this particular phone on this very specific iOS now with regards to looking at this search you mentioned that you used something called an artx tool is that correct yes sir and are you aware that's a that's a tool that was actually created by mran whin absolutely and with regards uh to with regard to this specific issue as far as how this inter this data is being interpreted from the browser say DB versus the knowledge C database and the wall file and all of those the pist and and all of those other kinds of things as far as the misinterpretation of the data has then caused Mr whiffin in further versions of cell right to revise that so that this kind of era can't occur sure happy to answer that so Mr wh's testing was not done with this spefic specific version of the iOS the iOS has been known to be changing the way this artifact Works uh to do proper analysis the researcher that yes he would have need to work with that same iOS now regards to the cellb question they have two versions of the cellb fysical analyzer one is the standard physical analyzer that's been out for several years now probably is majority use in the community uh it's a tool that takes out raw data and it puts it into human terms that we can look at and understand and write reports like like you've been seeing here so they have the CBR fysical analyzer that's out there I believe it's 7.68 but don't quote me on that and then they have a new version that's coming called insights and this operates uh more on where you can put multiple cases in and that it's only the Insight versions that they have bothered updating and no longer reporting on that time their current physical analyzer program and I tested this a few days ago still reports on that search occurring well and that time stamp So currently CBR is providing examiners law enforcement and people worldwide with two different versions giving two different results that I can't speak to more than that other than I've tested that and I see how those programs are working now so my question sir yes or no is are you aware that cele has had to modify their software based on misinterpretation of data as you've done in this case yes with a they updated one of two programs okay right Mr Green you are all set thank J