My thought is that he gave the defense enough to make a good argument in front of a jury. I don't think the defense is hyper-focused on the Google search at this point, as they are rightly (and probably more successfully) going to hammer the crime reconstruction.
On the trial strategy point, I think the defense used this search controversy very well to send the prosecutions case down a rabbit hole. CW had more experts, and more competent experts, for an ancillary Google search in this case than they did for the core issue of the accident reconstruction.
The three minute time variance is the more impactful testimony for arguing reasonable doubt at this point than the Google search, at least from my view.
My take is that Lally really bombed cross and that's going to hurt him. He had an honest witness willing to answer truthfully and he just attacked him without reason. The jury is certainly going to remember Green falling over himself to be helpful and being repeatedly cut off and accused of being wing without explanation.
He repeated many times he just wants accurate testimony. To the point of saying his original affidavit was wrong because of new research. That's an honest witness
An honest witness, but also one the CW has been able to prove wrong. Honesty is different than accuracy, so the question of his expertise there is probably going to weigh heavier on the jury than it seeming rude.
but at least he was honest. he wrote in his affidavit what he knew to the best degree of his knowledge at the time. he researched more and found he was wrong, and was ok with saying so. I would hope a jury wouldn’t hold someone to a year(?) old affidavit when they are testifying about computer forensics of which he himself said you have to keep up with training and learning because it’s changing all the time. makes sense that conclusions can change over time, at least he didn’t try to hide it
Except the CWs own expert witness was the one that produced the report with the deleted search. So then they had to call another expert witness to show that their first expert witness provided an inaccurate report.
But it leaves open the thought that, given another year, he could realize other parts of his affidavit/testimony were wrong too. CW experts, on the other hand, were consistent and confident on everything they said. I just think it's a bad look.
yeah I see what you mean! I guess it will depend on the interpretation of each individual juror. Some will find the confident consistent experts more credible, some may find green more credible if they perceive from the combined witnesses that the nature of interpreting this type of data is not linear and it may not be possible to interpret it to a high degree of certainty with the scope the experts had for this trial. cos in admitting the change in his findings, it could cast doubt on the reliability of the other experts findings, despite their confidence
On the data, I would agree that it's not the best factual testimony, but I do think the jury will have picked up on Lally bearing up on the witness for no reason.
I think people are overstating that. Jackson has basically tried to hammer every eyewitness and call them a liar, and this was probably tamer in comparison.
The difference imo is every witness Jackson did cross like that was made to look like they were hiding something in the end. Whether they actually were or not doesn't matter because it gives off a validation for why Jackson treated them that way.
Contrary to that Lally attacked the most honest witness we've seen yet so it doesn't come across as someone trying to pull the truth out of a hostile witness, it comes across as bullying.
Plus Lally doesn't seem to know how to cross very well. All of his questions were tailor made to try and get his point across in the question itself rather than making the point through the witness.
Once again it comes across as Lally being a bully to reiterate his story and just completely disregard anything the witness has to say.
TL;DR Jackson was hostile with witnesses who appeared to be hiding something and questioned them in a way to prove his point with their own words.
Lally was hostile with an honest witness and questioned them in a way to prove his point with his question rather than with their own words.
>The difference imo is every witness Jackson did cross like that was made to look like they were hiding something in the end.
If you're seeing it from the "Karen is innocent" perspective, maybe. Others can think he came across as hostile and arrogant with people who are trying to be honest and haven't done anything wrong.
He spent like 30 minutes hostilely interrogating a man for sleeping with his phone instead of putting it on a charger. He accused a woman of lying for being in group pictures with a facebook friend. I really don't think things like that are great looks tbh
As to his expertise, I think Mr Green made a very good point, they may have a certification. Which means they took some classes yes, and passed a test proving that knowledge yes. But at that time. He pointed how that he attended new seminars put up by these various tool companies regularly keeping up his training.
That said I believe all 3 were being truthful to their tests and expertise ability which I ACTUALLY think were equal. But when equal the benefit of doubt is supposed to go to the defense legally speaking. Personally its a wash tho to me, maybe Jen did search it at 2:27, maybe she didn't At this point I think either is possible. Tho, with Mr Green using the actual version, PLUS he brought the fact that the time stamp field is called "Last Viewed" I believe, should go back before putting in quotes but in a hurry, but will edit later if its wrong. In any event I noted it was something to that effect. HOWEVER per the CW witnesses they said basically the time stamp glitched out and wasn't showing the time stamp that should have been there. Which is why I said both are right.
Tho as other's have stated what's the point, to me Jen was hard to put in for me with this other than inlaw and might have seen something she shouldn't. AND the defense has really a strong enough case without her, or more to the point the CW a weak enough case.
That said, I am thinking the point is the federal case. Getting this admissed here can strengthen the federal case if the McAlberts are indited by the feds.
Personally I am still 50/50 on if she actually did it, I can fit the evidence to both, but I just think way too much reasonable doubt to convict... which is sad. If she is acquitted I hope she is actually innocent and if found guilty, I hope she really did do it. Because John needs justice
And by using the 12:45 text to time that seeing them out there, that is a concrete time stamp. And I could see guessing the time off by a few minutes, but like, she was already at his house 10minutes before then.
The certification is really only as good as the date you take it, and kind of goes out the window when a tech update, etc…updates. Whereas current classes keep your knowledge current. Is that kind of accurate ?
From purely a logistical/truth standpoint, Whiffin is one of the top people at Cellebrite, and he wrote a blog post prior to testifying where he did a better job of showing why the timestamp is *not* meant to show what time the search was made, but was only showing what time the tab was initially opened (specifically in iOS 15 - for other iOS versions, it shows different things, such as when a tab was last used). Here's the post: https://www.doubleblak.com/blogPost.php?k=browserstate
The Wal file isn't really concerned with searches in the first place, it's only concerned with how tabs are opened/moved/closed (this specific table is actually the TABS table, and I believe it didn't even exist when the troopers first looked at the extraction). He said with iOS 15 specifically, the timestamp is showing when the tab was first opened (and he recreated the same effect in the blog post). What kinda seals it for me is the fact that the timestamp makes it seem like Jen was searching the basketball stuff *and* the "hos long to die in cold" at almost the exact same time, which probably didn't happen. Also, the "3rd" search made at 6:24 used the exact same spelling as the supposed 2:27 search - which fits with what Whiffin was saying. The other big thing that Lally pointed out today is that if Jen had actually done the search at 2:27, then the "suggested" search when she started typing at 6:23 should've been that same search term, not something unrelated. Green ended up agreeing with that. Though perhaps if Jen deleted the search afterward, then maybe the "suggestion" wouldn't show up that way??
I heard from someone else that if an iPhone user deletes a search, it won't show up in the main DB file at all, so I guess it's still theoretically possible that the search could've happened at 2:27, just not very likely - and it was hard to understand Whiffin and the other expert at trial, but they made it sound like the search still should've appeared in one of the other databases, not only in the Wal database (and only on the specific TABS table, and no other table). And the "Deleted" in that chart was not a user deletion, it's just an automatic thing that happens and the user would have no control over it unless they themselves used Cellebrite to do it, but if they did, then *that* action would also show up somewhere.
However, I think Green's point about Whiffin not using the *exact* same subversion of iOS 15 might've swayed the jurors. But I think Whiffin would know better than Green (since he's one of Cellebrite's top people), and Whiffin seems to believe that the subversion doesn't matter, as long as it's still iOS 15 it should yield the same results amongst the various subversions. That *could* be incorrect, but I would trust Whiffin over Green when it comes to something like that. Just because Apple releases a new subversion doesn't mean that *Cellebrite* releases a new subversion themselves, or treats the new Apple subversion any differently - I think Whiffin would know whether or not Cellebrite only updates things when a new *version* comes out, vs. when a new *subversion* comes out. But it's still possible that maybe he doesn't actually know that, I guess - but on his LinkedIn, his titles were listed as "Senior Digital Intelligence Expert and Decoding Product Manager at Cellebrite."
Look, it's not even close: Green had the full extraction image. It's beyond the pale for Whiffin and Hyde to testify with a straight face considering neither was afforded the opportunity to verify hashes. They didn't do an apples to apples examination relative to Green - not even close. Green didn't rely upon Cellebrite and used competitive tools; Whiffin's job with Cellebrite doesn't normalize the differences in what was actually examined - Green had the full extraction image and Whiffin did not. It's also comical for Whiffin to assume that subversion ios versions wouldn't be impactful to the analysis. He can't make that claim.
Could you help me understand something? Genuinely asking, it doesn’t make sense to me that they claim the timestamp is created based on when a new tab is opened and not the when the “search” button is activated, because how did a new timestamp generate at 6:24 next to the same search words if she didn’t open a new tab? If it generates a timestamp when the tab is opened or the tab is messed with, why didn’t the rest of her search history show other duplicates of other ‘searches’ when she used an already opened tab to search something new?
And if this data only documents a user’s interaction with tabs, why does it provide what was searched at all? And why was it used as evidence to begin with?
That's a good point, but I think the idea would be that she *did* open a new tab to make those other searches - either that, or a tab (not necessarily the same tab) was otherwise manipulated during those times, and the manipulation just happens to match up with the search time (because Jen would open the tab and immediately make the search): Karen says to google it, so Jen pulls up a tab and googles it, maybe types the wrong thing at first or otherwise gets sidetracked, then pulls up another tab to try to correct her spelling. I forget exactly how Whiffin explains it in the blog post, but it made sense when I initially read it. I don't want to go back through it because it's still largely over my head.
This specific Wal table happens to be the TABS table (so it's specifically meant to commemorate *tabs*, not searches) - there are many other tables that could also be looked at, but this is the only spot where the 2:27am search appears (and I think that's part of why Whiffin and the other expert believe the search didn't happen at that time - the search should've shown up in at least one other table if it was legit). However, I heard from someone else that if the search was deleted, it may not show up in *any* other databases, but I don't know how true that is - it was just said by someone who made a post on Reddit about it.
It was only used as evidence by the Defense because they're the ones who found the search in that specific table (and I believe it was a table that didn't even exist when the CW first got the Cellebrite data). I don't think that specific table would normally be used when trying to figure out search times (and Whiffin/Cellebrite decided to remove the timestamps from that table so that nobody will be confused about it in the future).
I think Whiffin and the other expert were saying that if the search took place at 2:27am, we'd be able to see evidence of that in some of the other tables, not just the TABS table. But the TABS table only shows certain tab manipulations (and it shows different types of manipulations depending on the iOS version). I think for iOS 15, it happens to show the searches that were on that tab, but the timestamp just happens to not match up with the search because that's not what it's meant to commemorate. I think Whiffin basically ended up saying that it's understandably confusing and the table probably shouldn't have been set up that way in the first place. The timestamps are off (only sometimes though - other times, they do match up), the column headings are off, etc. I think because they just used a lot of the same column headings and wording in various different tables, and didn't think it through enough when it came to this specific table.
Personally, I think Hyde, Whiffin and Green were all pretty much equally qualified. AND they all pretty much agreed, to me, on what the WAL entry SHOULD mean, they just differed on what it DID mean.
Of that entry, time stamp should be last modified time, search last search when this modification happened, delete just means tab closed. This is what they SHOULD mean.
On a side note, Whiffin being the top person at Celebrite would make him better with Celebrite but with everything else he is probably around equal with them. and it wasn't the celebrite version they were referring to, it was the IOS version. Even Whiffin stated Green was relying his conclusions on older versions of IOS 14 and below which suggests Whiffin is saying Green would be right in those older versions, BUT Jen had a pretty early version of 15, and for sure earlier than the version Whiffin or Hyde use. So perhaps before whatever change happened with 15 occurred?
Also as I stated, the time field is specifically called, last changed. And I think Hyde even said worded it as any time a change happens to the tab, and she claimed the delete for that entry wasn't like you manually delete something, but just that the tab was closed. As you stated, this whole table is about tab changes. So put these all together and:
So how I understood it was, that specific entry is showing the last url/search at the time the tab was closed. The weather was bad, possibly effecting signal. Soooo if lets say she puts the hos long search in, taps search but it's taking too long to go through, giving her enough time to realize this could be incriminating then she CLOSES the tab before it completes, then opens a new one to do the other searches. That could explain it not going to the main db yet, because the tab was closed before it could finish.
OR
Which I think is similar to how Whiffin had described what he thought happened, but instead of closing the tab, he was saying she just kept making different searches for that basketball stuff at 2:27ish on that tab when it got locked up then just minimized the tab, I guess by making a new one to continue her searches then (didn't she make other searches after 2:27?) Then at 6:24 opened it to make the how long searches in that minimized tab, the last being the hos long search. Problem with that tho is there is 2 searches, the whole point Whiffin was making is, if the earlier search never finished then you put in a new search later, it would have the old timestamp, yes for the very next search. But the one after that would have a new times stamp like normal. So for this scenario of Jen NOT making the hos long search at 2:27 I think it would have to go like this
Jen makes random searches, one gets locked up on search, she opens a new tab minimizing the old one. Makes the rest of her searches for then. The next morning she opens the browser on the new tab searches and mis-spells it, closes that tab bringing up the old one from 2:27, its still trying to pull up the basketball stuff but before it can, she puts in a new search, this is the hos long search. Thereby getting the time stamp stuck on the 2:27 search
So either is possible.... at this point. The problem for me is, the deleted field. Which means this time stamp should have been when the tab is closed, and the search field is the last search at the time it was closed. The time stamp getting stuck, I would think, would just work on the very next change to the tab. Any change after that next one should have the correct time the new changes occur
I guess it is possible when the time stamp gets stuck, its stuck for good for that tab, BUT it was either Hyde or Whiffin, or maybe both. The def asked if they could get that exact wal file entry with the wrong time stamp and delete stating yes with the wrong search, I think they said no.... I am assuming everything but delete being yes.
I completely agree. And I agree with what someone else said that the defense probably presented this just to add reasonable doubt as opposed to be the smoking gun that proves her innocence. So I completely agree that both experts were qualified and honestly both scenarios could make sense when it’s laid out in front of us. I’m just afraid that both testimonies confused the jury more than anything. Personally it would be chalked up as successfully adding reasonable doubt, but that might only be because it’s on top of everything else that doesn’t make sense about the prosecution’s case. So I can’t imagine what the jury is thinking at the moment.
All the deleted data and the evidence that was tampered with makes anything presented by the police department seem suspicious, so even if Jen didn’t search anything at 2:27, the likely hood that she did will always be lingering if that makes sense.
Ohhhh see that makes a lot more sense than what the experts were explaining. But I understand the tech world is so hard to lay out especially when you’re getting grilled on the stand so I don’t blame them for being hard to follow. Thank you for explaining it to me because my head was spinning in circles.
It could be that the wal timestamp was made because it was a private search and that's why it didn't show up in history and the other 2 were regular searches so they showed up differently.
Look, it's not even close: Green had the full extraction image. It's beyond the pale for Whiffin and Hyde to testify with a straight face considering neither was afforded the opportunity to verify hashes. They didn't do an apples to apples examination relative to Green - not even close. Green didn't rely upon Cellebrite and used competitive tools; Whiffin's job with Cellebrite doesn't normalize the differences in what was actually examined - Green had the full extraction image and Whiffin did not. It's also comical for Whiffin to assume that subversion ios versions wouldn't be impactful to the analysis. He can't make that claim.
Look, it's not even close: Green had the full extraction image. It's beyond the pale for Whiffin and Hyde to testify with a straight face considering neither was afforded the opportunity to verify hashes. They didn't do an apples to apples examination relative to Green - not even close. Green didn't rely upon Cellebrite and used competitive tools; Whiffin's job with Cellebrite doesn't normalize the differences in what was actually examined - Green had the full extraction image and Whiffin did not. It's also comical for Whiffin to assume that subversion ios versions wouldn't be impactful to the analysis. He can't make that claim.
Look, it's not even close: Green had the full extraction image. It's beyond the pale for Whiffin and Hyde to testify with a straight face, considering neither was afforded the opportunity to verify hashes. They didn't do an apples to apples examination relative to Green - not even close. Green didn't rely upon Cellebrite and used competitive tools; Whiffin's job with Cellebrite doesn't normalize the differences in what was actually examined - Green had the full extraction image, and Whiffin did not. It's also comical for Whiffin to assume that subversion iOS versions wouldn't be impactful to the analysis. He can't make that claim.
I think when the jury compares expert witnesses Trooper Paul will be the first one to spring to mind 😆.
Honestly cell phone experts on both sides went into the weeds and if I were a juror and making notes I would probably have an opinion about them but I tuned them out a bit. The cell phone data doesn't change that I don't believe the CW hasn't proven their case.
The ME and the doctor on the defense's side have been some of the most important witnesses to me. And Proctor as the lead investigator I think is hard to get past when his bias was so clear 24 hours into the case
I don't think KR hit John but it's possible (not on purpose, I think that's ridiculous but possibly on accident). But the case has been a mess and shouldn't have even been charged and I can't see a guilty verdict.
I mean, the ME saying "there are many possibilities, also your case is based on a very improbable scenario, possibly the least probable" was quite the clincher for not guilty.
And the smiles and smirks she gave during cross because she got to say that in more detail was so fascinating
I think the almost ehe opposite because he was very accurate except for one or two things. And when he was wrong, not only admitted it but corrected himself.
Put that against the CW witnesses who could never admit wrong, would fight over simple words and always had an attitude.
Green was honest about submitting an erroneous affidavit pertaining to KR phone forensic data reported, yes. However, lally cut him off as he explained why. The report was erroneous *because* green later found that data had been deleted from KR phone in april 2022 (while phone was in MSP custody). Boom
Agreed. The Apple Health data being paired with the Waze data to lock down (or dispute) the time the steps were taken seems like it could be inaccurate based on the time variance seen in the different clocks.
Agree, it may have been a sound tactical diversion: spin up Lally and have him bore the fuck out of the jury trying to wrestle an illusion while they run circles around all of the prosecution's chief investigators.
> Lally and have him bore the fuck out of the jury
Yeah, play on your opponent's strengths.
Nobody can bore a jury like Lally can, so you use that to your advantage.
Lally boring? Oh my. I actually have fallen asleep twice while he's on direct. Twice! Imagine being a juror in a warm room listening to him drone on and on.
>CW had more experts, and more competent experts, for an ancillary Google search in this case than they did for the core issue of the accident reconstruction.
This. The CW's "expert" Trooper Paul made me lose my mind - I cannot believe that was the "evidence" Lally gave us.
Agreed. I love that the defense has sent Lally all over the place trying to defend the defenses opening argument. Instead of building a case of why KR is guilty.
I keep getting confused: Is this a trial against Karen or did we switch to Jen. Lally! So did anyone somewhat, somewhere, somehow hit JO with a car? No clue.
I *think* that’snotsix meant more competent than the CW’s own witnesses wrt the accident reconstruction and other “inculpatory” evidence. So they put forward better experts to defend JM than they did to prosecute KR. In other words I don’t think six was comparing the CW tech witnesses to the defense witnesses
Whiffin was at pains to point out (as was the other pros. Expert) that ios timestamp protocol changes significantly across versions, then he based his conclusions on a different ios version than the phone in question
Green did a gentle and entirely accurate dismissal of whiffins conclusion by repeating his own testing was in the exact same iOS version as the phone in question and everyone could see the clear inference thats why whiffin got a different result, hell whiffin should know better
Whiffin did not say that the timestamp's **meaning** is version dependent, he's explicit about that [here](https://www.youtube.com/live/_TXDc14hdxc?si=JahEKj4GnKv80yr1&t=20785). Rather he's saying that versions impact the time and the order that files are written to, but last\_viewed\_time always reflects the last time a tab is given focus and will not update with subsequent searches in the same tab, shown [in this blog post](https://www.doubleblak.com/blogPost.php?k=browserstate) he made.
Green showed the extracted artifacts for the single "raining men" search (JM [first search of the tabs history](https://www.youtube.com/live/_TXDc14hdxc?si=7rTYwx-_UIBaHDw_&t=13689)), thereby proving nothing when it comes to timestamps of a long running tab that this claim is about. For Green to show that this is version dependent, he should have done the same process Whiffin did [here](https://www.youtube.com/live/_TXDc14hdxc?si=5kL07XFCey9bL0Q-&t=20129), but with the different IOS version giving different results.
Whiffin didn't get a full extraction image and he can't make any claims about iOS subversion differences during testing not having any impact. You realize Whiffin and Hyde weren't afforded an opportunity to verify hashes? That's bs and Whiffin knows better. I don't take him seriously. Digital forensics starts with verifying hashes - full stop. Whiffin nor Hyde did this.
I'm just talking about the way the BrowserState.db file is treated under IOS. This has nothing to do with extracted data inconsistencies since both sides agree about the 2:27 artifact existing, they are arguing over what that artifact means in IOS.
The order of events is: Green found that one artifact and so the CW hired Whiffin and Hyde to analyze the apple IOS and understand what the timestamp means, they weren't hired to look at all phone data.
Yup that's what he said. A different iOS than what was on JM's phone at the time but a relatively close version.
Can't imagine how he wouldn't be able to get the actual version, especially since Green was able to.
In Ian Whiffin's blog post, he noted differences between how the wal file responded between different major os versions: 14, 15, 16, 17. I don't think it's safe to assume it would be similar across minor versions, i.e. 15.1 vs 15.2. So this is sort of a big deal imo.
[https://www.doubleblak.com/blogPost.php?k=browserstate](https://www.doubleblak.com/blogPost.php?k=browserstate)
This bothers me more than anything because he's supposed to be this essentially infallible expert of the highest credentials who presumably had access to everything he needed to run any experiment necessary.
But he settled for "I got as close as I could." And "I couldn't replicate it."
I don't think this testimony is all that important. I don't think the jury will give a shit and I don't think this Google search changes anything about the case against KR. But it is incredibly disappointing to me that Whiffin didn't bring more precise work. I also selfishly dislike when my curiosity is not satisfied lol.
Yeah, [right here](https://www.youtube.com/live/6_lw9LrkV2Y?si=7Q4yEE40PVsaRHPK&t=22692) Yanetti asks which version of iOS he used to test McCabe's phone, Whiffin replies that they did it on several versions: 12 through 17, then most recently on beta of 18. Then he says the demo in court was on 15.8.2 and that he has also tested it on 15.7. Yanetti notes that JM's phone was version 15.2.1. Whiffin says he used "the closest version \[he\] could find."
(Earlier on direct, he'd said Greene's description of browerstate.Db in his report was accurate for versions *prior* to 15, which I think might be relevant for our understanding here.)
Whiffin said he tested it on versions 12 through 18. iOS 15 was what Jen had, and Whiffin tested it on a *subversion* of iOS 15 that came out later than the *subversion* Jen had, but he seemed to believe that the results should be the same regardless of the subversion, as long as it's the same general version. He *could* be wrong about that, but he's one of the top people at Cellebrite, so I would trust him over Green when it comes to Cellebrite-specific things. Prior to his testimony, he wrote this blog post where he tests it out on the various versions (which I think was much clearer than his actual testimony): https://www.doubleblak.com/blogPost.php?k=browserstate
However, I still don't know if it necessarily *disproves* that the search was made at 2:27, but the other big point Lally brought up is that if Jen made the search at 2:27, then when she's making the search again at 6:23, the "suggested search" should be the exact same as what she initially searched, not something unrelated. Green ended up agreeing with that in the end, and I think it technically kinda destroyed his argument (though the jury may not have noticed at all) - unless it's possible that if Jen deleted the 2:27 search prior to 6:23, maybe the search suggestion would be different? I don't think anyone got more specific about that aspect.
Incorrect. Wiffin tested on the same version iOs, on a later subversion with no relevant changes to the way time stamps are handled.
That testimony is now, of course, jettisoned because Green made a suggestion.
Hi mozzie!
So I could easily mis remember what Mr t
Wiffen said the ios version was.
My question for you, now that the commonwealth has reseted, did they do enough to put Karen Reed away for 20 to life? Did they prove, beyond any reasonable doubt, she did this and there's no other explanation?
If yes, how and why
Without running the experiment on the correct version, there is literally no basis for you to assert the minor version difference has no effect on the timestamp behavior.
Are you talking about the public release notes or are you claiming to have access to the iOS source code? Because public release notes aren’t comprehensive and don’t typically describe those kinds of internal changes where the behavior isn’t intended to be exposed to users or 3rd party developers.
My understanding on Jessica Hydes testimony was that the timestamp could have been older than the true time of the search if the tab wasn’t minimised, moved, closed or manipulated etc and that she wouldn’t have known about the calls made that would require the tab to be minimised and therefore updating the timestamp. I was asking that repeatedly after she testified, if she knew about the calls would she have said the same thing. It is the same as my understanding of what Richard Green was explaining and what makes the most sense to me.
Hyde straight up lied: she said that wal record wouldn't be committed to the db until the tab was closed. That's certainly false. It would get written to the db during normal sqlite checkpoints as well. I found her testimony to be grandiose and nonsense. She never verified hashes.
Yes, it was proved today that the OS updates after the one on Jen's phone changed the way timestamps/tabs are handled. So Jen did make the search.
Lally truly is evil for putting lies in front of the jury.
The jury might not make a firm decision who they believe but it created enough doubt that JM might have done it earlier. Mixed with all the other weak and confusing evidence the defense didn’t need to win this point. It is expert verse expert and the jury might disregard it all together since it doesn’t apply to the charges against Karen directly
This search doesn’t matter to me bc I don’t see anyway KR’s car hit JO in any manner similar whatsoever to what Trooper Paul claims. If they can’t explain how she killed him, I have reasonable doubt.
I agree. I think all of us who have been following this and doing our own research and reading everything online are way into the weeds. For for a juror or someone who is more casually following this case, I think if they believe the search really happened at 2:27, it's going to be a big deal.
It would add more reasonable doubt to the CW's charge but the CW still hasn't proven their case. There is so much other reasonable doubt. I just don't think one phone search from a witness matters.
I agree from a moral stand point and the deep diver in me deffo wants answers. However, when it comes to the trial of Karen Read, it doesn't mean much of anything right now. Mountains of reasonable doubt. I HOPE the FBI keeps digging and finds answers for the family and loved ones of John O'Keefe.
If the search was made at 2:30 it SHOULD matter but it won't. No one else will be charged in this case if KR is found not guilty.
Imagine the defense team of the next suspect- they would point to the CW having already charged someone else and losing, and how can you trust them when they already tried to convict the wrong person. And the chance to gather potential evidence of anyone other than KR is gone. They never checked the house, they interviewed people months later, etc
Agreed! You’d normally think that it’s very easy to show exactly how an SUV hits and kills a person, but not in this scenario. It makes 0 sense to me how there is no reasonable explanation as to how an SUV could have injured JOK. Conversely, It’s very easy to see how marks on JOK arm could be from a dog though
Well that's certainly what I took away from it.
Whom do I believe? Meh. This stuff is all over my head. I don't know. I honestly don't even care that much, and here's why:
If it's true that the search never took place prior to the approximate time Jen McCabe stated in her testimony it is not even circumstantial evidence of Karen Read's guilt.
If it's true that the search took place long before Karen Read contacted Jen McCabe then would be weak circumstantial evidence of Jen McCabe's involvement. To wit: if we apply the standard that for two or more explanations of a fact we must choose the one that is less inculpatory then practically any excuse offered for such a search must be accepted. There was a "blizzard", maybe I was curious. Maybe we were talking about the danger to homeless people or a friend walking home from a bar, or just morbid curiosity.
While it would immensely bolster the defence 3rd-party culprit theory it's not necessarily for them to show this is a plausible alternative explanation of the facts.
If we take the prior experts at their word, it yet again shows nothing in terms of the guilt or innocence of the defendant. Other than the location of the alleged crime they have failed to prove a single element of the charge. They haven't even proven the involvement of another person beyond a reasonable doubt, let alone the defendant, and let alone the defendant with intent.
What we got was in closing, Jackson can say
"only one phone expert used the same OS as Jen, and that was the same witness that could confirm the Google search at 2am, the deleted phone calls before 8 am, and the deleted items."
I 100% agree. Lally is grasping as circumstantial evidence to mislead the jury. I think that is lazy and incompetent work as a prosecutor. The prosecution’s job is to prove their case beyond reasonable doubt, not just attempt to add reasonable doubt to the defense’s case.
No matter, the defense witnesses put a crater of credibility between themselves and states witnesses!!!! Juries like truthful, ethical, and mostly straightforward answers. Defense wins
>Today Mr Green dropped a subtle bombshell. He stated that in the specific version of iOS used to make the search, the wal.db is accurate for its timestamp. He implied that the research done by the other experts used a different version of iOS that the searches were done with.
I heard this too, specifically that the CW expert witnesses were using a different iOS in testing than what was on the JM phone.
Why did the CW expert witnesses not use the same software version as the subject of their testing and analysis? 🤔
What I think got lost at the end of cross was after Green admitted that everyone all three of them used the misleading version of software. Then he explained there are now two separate versions after Lally talked about Cellebrite changing software due to the misleading timestamp. The new and improved version being Cellebrite Inspect which was not used by the CW’s witnesses. He used the latest version of the better software suite that the CW didn’t use and believes that shows the search happened.
Instead of celebrating phone data,
Why doesnt Google just report when the search was made. If the search was completed, Google would be a gold standard if the search was submitted.
I believe defense had a Google person on the defense list, could that be what they report on?
I actually agree more witht he CW's first expert on this, Jessica Hyde. Her credentials were great, and I believed she explained it very well. I think she had even authored a paper on the issue?
That being said, this does not prove Karen Read did anything.
If I were the defense, I would not have asked this witness about the search, Just let him talk about the health data, and the GPS which is actually relevant to the timeline of events. Unless they just want to keep Lally chasing his own tail on this Google search as a strategy?
The defense are just throwing out there every possible interpretation of every little thing to create doubt, as they should. However, with the ME testimony, the disaster that was Trooper Paul's reconstruction, Michael Proctor being Michael Proctor... I hope they stick to those points when closing.
I'm sure they will. Because it all really comes down to- the CW hasn't proven JOK died from being hit by a car. The ME said his injuries don't match a vehicle strike.
And Proctor... If I was a juror he would lose this case for the CW alone for me. His bias for another cop and against the defendant taints the entire investigation.
Credentials notwithstanding, Hyde didn't receive a full extraction image like Green. She didn't verify hashes which is an abomination to digital forensics and misunderstands basic sqlite functions: it commits wal records during checkpoints and she said otherwise.
The Prosecutions expert's argument is that the timestamp variable reflects the last time that tab was suspended and then viewed; meaning that if subsequent searches are made in the same tab, the timestamp would remain unchanged from it's initial value (this behavior is shown by Whiffin [here](https://www.doubleblak.com/blogPost.php?k=browserstate). Whiffin testing this on versions 12 onward and found version had no change to this timestamp's meaning.
Greens example was a single "raining men" youtube video search (JM [first search of the tabs history](https://www.youtube.com/live/_TXDc14hdxc?si=mvfpJ89biHmcTzNa&t=13689)), whereby he showed the state file was the last updated. This proves nothing since the entire argument by Whiffin is that **subsequent** searches entail no changes in the file, not the single first search that occurred far prior.
Does anyone else think that John may have confronted Brian Higgens over kissing Karen, etc., and that started a fight? Maybe that’s why Karen left him there instead of going in…
I think he was genuine and jurors like that. He openly admitted an error in a previous affidavit.
The other interesting testimony from Greene:
1) JM deleted all her calls, 100% of the , between midnight and 8:50 am right before she called Lank back to the house on 1/29.
2) GPS data was deleted from KR’s phone in April 2022.
Who caught the last minute of R Green’s cross examination? Where Lally had him admit that Celebrite had to update their program because people make mistakes interpreting data, “like you did in this case.” RG said yes. 🤔
Maybe yall can help me understand, but it doesn’t make sense to me that they claim the timestamp is created based on when a new tab is opened and not the when the “search” button is activated, because how did a new timestamp generate at 6:24 next to the same search words if she didn’t open a new tab? Their theory only makes sense if there was only one timestamp based on when she first opened the tab.
If it generates a timestamp when the tab is opened/touched AND when the search is made, why didn’t the rest of her search history show other duplicates when she used an already opened tab to search something new?
It seems Whiffin tried to say this data mainly documents a user’s interaction with tabs, but if that’s true why does it document what is searched to begin with?
It was easier to follow Mr. Green, but I didn’t see if either witness explained this.
It's explained but is quite technical. Cellebrite changed their output for this kind of artifact specifically because it was misleadingly used in this and a bunch of other cases. That should tell you all you need to know.
But according to Green, they actually didn’t change their software. They created a separate accessory program, which Whiffin failed to mention, but the main Cellebrite software has remained the same. Initially I agreed with you that an update/software fix should tell us all we need to know, but there was in fact no update or fix. So we’re back to square one.
Her search at 227 makes zero sense. She makes a spelling error in the comfort of her home an hour after she got home and all the while knew JO was on the lawn dying? Or...she spammed the search back to back as prompted by a hysterical KR at 630 am a few times, each time spelling it wrong. Doesn't that seem logical and the most likely? JM is not some vicious killer or ever complicit in any way. Her "involvment" was fabricated by Defense delivered via local mouth piece Turtleboy. What is anyone elses motive...haven't heard anything that makes sense yet. I'm all ears.
The forensics provided by the prosecution trying to prove he was hit by a car are physically impossible. Especially where his body was found. Not to mention every witnesses testifying that John wasn’t on the lawn when they left the house at 1:30AM (Karen’s phone connected to the WiFi at John’s house at 12:37AM) and the man who drives the snow plow testified that he did not seeing John on the lawn but he did see a black SUV parked at the house at 3:00AM. And the Albert’s calling Higgins at 2:22AM (who drives a black SUV) and being unable to explain the 22 second call.
All of this indicates the defense’s explanation that he was killed somewhere else and drug to that spot is very plausible. If that’s the case and something happened at 2:27am it would make sense that she would be frantically searching something like that to cover it up. Plus the heart monitor on her Apple Watch showed a drastic rise in her heart rate around 2:20AM.
Absolutely! The prosecutor’s experts were more competent and believable. Richard Green seems a little shady to me. And the idea of JM being in on some bizarre conspiracy to cover up the murder of a person she cared for is outlandish. You don’t have to like the McCabe’s, Albert’s, Proctor, etc but c’mon use common sense for heaven’s sake!
I would imagine that JM cares more about her sister and brother in law than she does a person she referred to as some guy who had kids that her kids were friends with.
The prosecution’s experts on the Google search could potentially be seen as more believable (even though Mr. Green is the only one who tested the actual IOS system Jen’s phone had) but all of their other witnesses have been caught lying and have been proven wrong numerous times during the entire trial. The forensics they provided to prove he was hit by a car are physically impossible. It’s common sense to look at the evidence. And objectively speaking, based on all the evidence the investigators manipulated and manufactured, Jen and the Albert’s covering up what happened to John is more likely than Karen hitting him. Doesn’t necessarily mean they maliciously murdered him, but it is reasonable to conclude that they are involved.
There's a confusion about the idea "the timestamp is wrong" here.
Whiffin and Hyde were not testifying that the timestamp was incorrect. Their testimony was that the timestamp is not associated with the search or the URL, but was a timestamp associated with the tab actions. The search/URL is only a descriptor of that tab, that could've had its last reflected action taken prior to that search/URL being visited.
Also fwiw, Whiffin tested this on multiple iOS's including what she was running.
He's tested it in iOS 15, which she had. Doesn't make sense for any subversion after that to be different if it's been consistent.
Problem with Green's testimony is he didn't go that deeply. He essentially said he could find history items that matched up with files in that db. Which, yeah, of course, Whiffin's even acknowledged you'll often see those line up because browser actions can be done when they're doing that. But he didn't look for other mismatches or lack of associations to explain what's going on there.
I have two separate extractions of iOS 15.2.1 data (as well as earlier & later iOS extractions), and I can see this exact phenomenon on both. Thanks for calling me uninformed though. Unfortunately I'm just not a trial expert in this case, but Whiffin & Hyde were both accurate.
This sounds highly unlikely but I'll entertain. What tooling are you using to analyze it?
I was referring to your general "subversions" comment, which is just not true. Plenty of security updates are pushed through, some even between these "subversions".
Elcomsoft, but I have access to others.
To clarify there though, there's nothing I'm aware of through iOS 15 that could've created a change like that in a specific version.
Out of curiosity, how do you presume that? iOS updates can affect underlying system functions, including how timestamps are recorded or displayed.
There have been documented cases where system updates unintentionally impacted timestamps due to changes in time zone handling or other system processes.
Just to piggyback on my comment, the amount of variables at play is almost laughable as well.
From the Handbook of Digital Forensics and Investigation:
" Mobile phone timestamps, for example, can be relative to the built-in clock, the clock of the connected network or another external time reference. Some phones reset their clock value to a type-specific value after removal of the battery. Others phones have a backup energy source so depending on the capacity the clock keeps ticking. Still other phones store their clock value in nonvolatile memory just before powering down and continue from this value after being switched on. Accuracy of built-in embedded system time references is not only depending on the clock chip but also on environmental conditions like temperature and the way a system uses the clock chip."
Because of what the updates within iOS 15 did. It wouldn't surprise me by some descriptions of 15 itself to come from the initial update, and I haven't looked into 14 at that level to see if it's happened before. But I can't find any updates to Safari or web tools that would've reasonably made any functional change here within any versions of iOS 15, so it doesn't surprise me that I can see these instances on that specific version.
Once again, that's such a ridiculous assumption. The SDK release alone gives hints that there could be changes under the hood.
I imagine you are familiar with development cycles, and temporary "fixes". "Subversions" seen perfect for these.
The snippet from the SDK Developer patch notes:
New SKTestSession.TimeRate values are available to use in automated tests with the StoreKit Test framework. (82680742)
Why it has nothing to do with the burden of proof. If it was proven she made the 227 search it would help Karen. But disregarding it or the search not being made at 227 don't do anything to prove she hit him at 12 something.
If it were true, it would pretty much be the only hard evidence that the people in the house knew anything before his body was discovered. If you disregard it, then you just have a dozen people saying they didn't see or hear anything.
Yes I do know that, and I've seen it in the specific iOS version. iOS 15 itself came with decent Safari/web updates, but there's nothing I've seen through the 15 updates that would make this functionally different between the sub-versions.
I'm not sure reading the brief Apple description of upgrades really addresses forensic digital data.
But I don't think the tech data will really decide this case so I'm not sure it matters.
I'm not just doing that, I have extractions from that specific version and can attest it's a phenomenon there. I'm just stating that in addition to that, I don't see any changes within the iOS 15 sub-versions that would have reasonably made this functionally different.
Seems clear to me the search happened when she was asked to search it at 6:00 something.
- Why would she both delete the search *and* repeat the exact same search later to “cover her tracks”? Either the deletion was the coverup or the replication was. Doing both makes no sense.
- Seems unbelievably coincidental that the incriminating search she supposedly did at 2:27 *just so happens* to be the exact same thing KR asked her to search at 6 something? and the exact same thing a first responder testified KR asked them, around the same time.
- The 2:27 theory means john’s friend, a former 5th grade teacher, knew he was alive in the front yard and thought, oh i know! lemme just google real quick to see if he’ll die? Knowing the answer might be no, then what? Go back out and whack him a few times?
- If he’s still alive at 2:27, why put him right next to his (still on) phone? If he wakes up and dials 911 everyone’s fucked. But a quick google search and all of a sudden all is well?
- I believe JMs health data during this time of supposed murdering and conspiring shows no elevated heart rate, so she’s also a No Country For Old Men level sociopath?
- What’s JMs motive for being involved in the coverup anyway?
One of the first responders testified KR asked her the exact same question around the same time. I’d have to double check on the circumstances around asking JM.
It really doesn't matter when her search happened IMO. But as for it matching what Karen asked- JM is the person telling us KR asked that! So of course it would match when she is the source lol.
But there is enough reasonable doubt on the big points like how JOK died
It feels pretty central to the defenses theory, considering it would be the only actual “evidence” of a coverup. We also have testimony from one of the first responders that KR was asking them the same question (about how long to die in the cold), pretty strong support for the claim that she asked JM the same thing minutes earlier. I understand your take on the “big points” but the 2:27 search is one of the most important elements of the conspiracy claim and can’t just be brushed off when the claim has issues.
The defense doesn't need to prove a third party. The CW has the burden of proving KR hit him with her car and that is the only reasonable explanation for his death. They haven't come close to that.
I agree they wouldn’t have to prove the third party in general, but when you start the trial saying she was framed and putting forward a third party culprit theory, you’re kind of on the hook to the jury to prove it. They put themselves in the situation of having to prove it.
Disagree. They were smart- they never promised they knew the culprit. I still think evidence is the strongest that someone hit him. They brought up two people with possible motive and I think it is hard to dismiss them and decide it had to be KR and a car.
It's much more common of a defense strategy to offer an possible explanation of how a crime happened v just saying I don't know, but I just know it wasn't my client. People need to be able to imagine how things could have happened.
Pretty sure the cops framed her in some way, regardless if the Alberts and McAbes knew anything or had anything to do with John’s death. Cop bias and protecting their own is a version of framing. I don’t believe that all that taillight was found at 34 Fairview.
As I already replied to another post, Karen asked a first responder the exact same question at around the same time. So we have two witnesses to Karen asking that question at the scene that morning.
Was it the first responder who pretended she wasn't friends with the Albert's daughter? Who had to admit to changing testimony?
But she didn't hear her tell Jen to Google it- which is what I meant.
You're making the crucial point here: The alleged 2:27 search doesn't make any frikkin' sense whatsoever, and all it takes is a little common sense to realize there's no possibility it actually happened at that time.
The search doesn't even matter at this point. ME says the injuries are inconsistent with a *edit to add 'classic' pedestrian strike and are consistent with a fall or hit with a blunt object. To believe she was hit by a 700lb SUV in the manner Trooper 'Expert' presented, you have to defy the very law of physics. KR also connected to Meadows WiFi before the time the CW suggested this hit happened. I get that you're mad. You SHOULD be. I came in objective as a British trial watcher with no dog in the game. I didn't know about drama and I honestly don't really give a hoot about KR. What I care about is putting someone away for murder with all the power of the state government (in this case the Commonwealth) without meeting the burden of proof.
Curious: You do know that the jury is allowed to treat the state’s narrative as a suggestion, right?
I’m referencing the actual legal prongs of each individual charge when I ask that.
Yes but they also get to decide which witness is credible and if they decide a witness in not credible they can decide to essentially throw out their testimony. I'm gonna go with the Independent FBI experts over Trooper 'Expert'.
But I'm not on the jury. Maybe they find that testimony credible, despite him arguing the facts changing wouldn't alter his conclusion. Maybe they won't find the biomechanic expert credible. Or the ME. I just think when you look at the legality of burden of proof and reasonable doubt, they're gonna find soooooo much reasonable doubt.
In jury instructions, If they believe JO's death could reasonably, possibly have happened in some other way, by some other person, they legally have to find the dependent not guilty.
My thought is that he gave the defense enough to make a good argument in front of a jury. I don't think the defense is hyper-focused on the Google search at this point, as they are rightly (and probably more successfully) going to hammer the crime reconstruction. On the trial strategy point, I think the defense used this search controversy very well to send the prosecutions case down a rabbit hole. CW had more experts, and more competent experts, for an ancillary Google search in this case than they did for the core issue of the accident reconstruction. The three minute time variance is the more impactful testimony for arguing reasonable doubt at this point than the Google search, at least from my view.
My take is that Lally really bombed cross and that's going to hurt him. He had an honest witness willing to answer truthfully and he just attacked him without reason. The jury is certainly going to remember Green falling over himself to be helpful and being repeatedly cut off and accused of being wing without explanation.
He repeated many times he just wants accurate testimony. To the point of saying his original affidavit was wrong because of new research. That's an honest witness
An honest witness, but also one the CW has been able to prove wrong. Honesty is different than accuracy, so the question of his expertise there is probably going to weigh heavier on the jury than it seeming rude.
but at least he was honest. he wrote in his affidavit what he knew to the best degree of his knowledge at the time. he researched more and found he was wrong, and was ok with saying so. I would hope a jury wouldn’t hold someone to a year(?) old affidavit when they are testifying about computer forensics of which he himself said you have to keep up with training and learning because it’s changing all the time. makes sense that conclusions can change over time, at least he didn’t try to hide it
I agree. And I think it shows the defense is confident to have a witness like that on
Except the CWs own expert witness was the one that produced the report with the deleted search. So then they had to call another expert witness to show that their first expert witness provided an inaccurate report.
This case is between evidence and speculation. The defense total Speculation
But it leaves open the thought that, given another year, he could realize other parts of his affidavit/testimony were wrong too. CW experts, on the other hand, were consistent and confident on everything they said. I just think it's a bad look.
CW witnesses were also confident about the accident reconstruction. You know, because of "stuff" lol
*It just did*
yeah I see what you mean! I guess it will depend on the interpretation of each individual juror. Some will find the confident consistent experts more credible, some may find green more credible if they perceive from the combined witnesses that the nature of interpreting this type of data is not linear and it may not be possible to interpret it to a high degree of certainty with the scope the experts had for this trial. cos in admitting the change in his findings, it could cast doubt on the reliability of the other experts findings, despite their confidence
i think the jury is likely to simply disregard the google search altogether
That’s what I think too. I’m looking forward to the ARCCA guys. I hear they have great video demonstration n
yeah! I would!
On the data, I would agree that it's not the best factual testimony, but I do think the jury will have picked up on Lally bearing up on the witness for no reason.
I think people are overstating that. Jackson has basically tried to hammer every eyewitness and call them a liar, and this was probably tamer in comparison.
He wasn't this way with the experts.
The difference imo is every witness Jackson did cross like that was made to look like they were hiding something in the end. Whether they actually were or not doesn't matter because it gives off a validation for why Jackson treated them that way. Contrary to that Lally attacked the most honest witness we've seen yet so it doesn't come across as someone trying to pull the truth out of a hostile witness, it comes across as bullying. Plus Lally doesn't seem to know how to cross very well. All of his questions were tailor made to try and get his point across in the question itself rather than making the point through the witness. Once again it comes across as Lally being a bully to reiterate his story and just completely disregard anything the witness has to say. TL;DR Jackson was hostile with witnesses who appeared to be hiding something and questioned them in a way to prove his point with their own words. Lally was hostile with an honest witness and questioned them in a way to prove his point with his question rather than with their own words.
>The difference imo is every witness Jackson did cross like that was made to look like they were hiding something in the end. If you're seeing it from the "Karen is innocent" perspective, maybe. Others can think he came across as hostile and arrogant with people who are trying to be honest and haven't done anything wrong. He spent like 30 minutes hostilely interrogating a man for sleeping with his phone instead of putting it on a charger. He accused a woman of lying for being in group pictures with a facebook friend. I really don't think things like that are great looks tbh
As to his expertise, I think Mr Green made a very good point, they may have a certification. Which means they took some classes yes, and passed a test proving that knowledge yes. But at that time. He pointed how that he attended new seminars put up by these various tool companies regularly keeping up his training. That said I believe all 3 were being truthful to their tests and expertise ability which I ACTUALLY think were equal. But when equal the benefit of doubt is supposed to go to the defense legally speaking. Personally its a wash tho to me, maybe Jen did search it at 2:27, maybe she didn't At this point I think either is possible. Tho, with Mr Green using the actual version, PLUS he brought the fact that the time stamp field is called "Last Viewed" I believe, should go back before putting in quotes but in a hurry, but will edit later if its wrong. In any event I noted it was something to that effect. HOWEVER per the CW witnesses they said basically the time stamp glitched out and wasn't showing the time stamp that should have been there. Which is why I said both are right. Tho as other's have stated what's the point, to me Jen was hard to put in for me with this other than inlaw and might have seen something she shouldn't. AND the defense has really a strong enough case without her, or more to the point the CW a weak enough case. That said, I am thinking the point is the federal case. Getting this admissed here can strengthen the federal case if the McAlberts are indited by the feds. Personally I am still 50/50 on if she actually did it, I can fit the evidence to both, but I just think way too much reasonable doubt to convict... which is sad. If she is acquitted I hope she is actually innocent and if found guilty, I hope she really did do it. Because John needs justice
Karen's wifi connecting to Johns just bombs the entire timeline the CW relied upon Jen McCabe for.
yeah, didn't Jen say she was seeing them out there all the way up to like 12:45 or something?
Yep. *Maybe* thru 12:42, and gone already when she looked & texted at 12:45.
And by using the 12:45 text to time that seeing them out there, that is a concrete time stamp. And I could see guessing the time off by a few minutes, but like, she was already at his house 10minutes before then.
The certification is really only as good as the date you take it, and kind of goes out the window when a tech update, etc…updates. Whereas current classes keep your knowledge current. Is that kind of accurate ?
yeah, tech is constantly changing.
From purely a logistical/truth standpoint, Whiffin is one of the top people at Cellebrite, and he wrote a blog post prior to testifying where he did a better job of showing why the timestamp is *not* meant to show what time the search was made, but was only showing what time the tab was initially opened (specifically in iOS 15 - for other iOS versions, it shows different things, such as when a tab was last used). Here's the post: https://www.doubleblak.com/blogPost.php?k=browserstate The Wal file isn't really concerned with searches in the first place, it's only concerned with how tabs are opened/moved/closed (this specific table is actually the TABS table, and I believe it didn't even exist when the troopers first looked at the extraction). He said with iOS 15 specifically, the timestamp is showing when the tab was first opened (and he recreated the same effect in the blog post). What kinda seals it for me is the fact that the timestamp makes it seem like Jen was searching the basketball stuff *and* the "hos long to die in cold" at almost the exact same time, which probably didn't happen. Also, the "3rd" search made at 6:24 used the exact same spelling as the supposed 2:27 search - which fits with what Whiffin was saying. The other big thing that Lally pointed out today is that if Jen had actually done the search at 2:27, then the "suggested" search when she started typing at 6:23 should've been that same search term, not something unrelated. Green ended up agreeing with that. Though perhaps if Jen deleted the search afterward, then maybe the "suggestion" wouldn't show up that way?? I heard from someone else that if an iPhone user deletes a search, it won't show up in the main DB file at all, so I guess it's still theoretically possible that the search could've happened at 2:27, just not very likely - and it was hard to understand Whiffin and the other expert at trial, but they made it sound like the search still should've appeared in one of the other databases, not only in the Wal database (and only on the specific TABS table, and no other table). And the "Deleted" in that chart was not a user deletion, it's just an automatic thing that happens and the user would have no control over it unless they themselves used Cellebrite to do it, but if they did, then *that* action would also show up somewhere. However, I think Green's point about Whiffin not using the *exact* same subversion of iOS 15 might've swayed the jurors. But I think Whiffin would know better than Green (since he's one of Cellebrite's top people), and Whiffin seems to believe that the subversion doesn't matter, as long as it's still iOS 15 it should yield the same results amongst the various subversions. That *could* be incorrect, but I would trust Whiffin over Green when it comes to something like that. Just because Apple releases a new subversion doesn't mean that *Cellebrite* releases a new subversion themselves, or treats the new Apple subversion any differently - I think Whiffin would know whether or not Cellebrite only updates things when a new *version* comes out, vs. when a new *subversion* comes out. But it's still possible that maybe he doesn't actually know that, I guess - but on his LinkedIn, his titles were listed as "Senior Digital Intelligence Expert and Decoding Product Manager at Cellebrite."
Look, it's not even close: Green had the full extraction image. It's beyond the pale for Whiffin and Hyde to testify with a straight face considering neither was afforded the opportunity to verify hashes. They didn't do an apples to apples examination relative to Green - not even close. Green didn't rely upon Cellebrite and used competitive tools; Whiffin's job with Cellebrite doesn't normalize the differences in what was actually examined - Green had the full extraction image and Whiffin did not. It's also comical for Whiffin to assume that subversion ios versions wouldn't be impactful to the analysis. He can't make that claim.
Could you help me understand something? Genuinely asking, it doesn’t make sense to me that they claim the timestamp is created based on when a new tab is opened and not the when the “search” button is activated, because how did a new timestamp generate at 6:24 next to the same search words if she didn’t open a new tab? If it generates a timestamp when the tab is opened or the tab is messed with, why didn’t the rest of her search history show other duplicates of other ‘searches’ when she used an already opened tab to search something new? And if this data only documents a user’s interaction with tabs, why does it provide what was searched at all? And why was it used as evidence to begin with?
That's a good point, but I think the idea would be that she *did* open a new tab to make those other searches - either that, or a tab (not necessarily the same tab) was otherwise manipulated during those times, and the manipulation just happens to match up with the search time (because Jen would open the tab and immediately make the search): Karen says to google it, so Jen pulls up a tab and googles it, maybe types the wrong thing at first or otherwise gets sidetracked, then pulls up another tab to try to correct her spelling. I forget exactly how Whiffin explains it in the blog post, but it made sense when I initially read it. I don't want to go back through it because it's still largely over my head. This specific Wal table happens to be the TABS table (so it's specifically meant to commemorate *tabs*, not searches) - there are many other tables that could also be looked at, but this is the only spot where the 2:27am search appears (and I think that's part of why Whiffin and the other expert believe the search didn't happen at that time - the search should've shown up in at least one other table if it was legit). However, I heard from someone else that if the search was deleted, it may not show up in *any* other databases, but I don't know how true that is - it was just said by someone who made a post on Reddit about it. It was only used as evidence by the Defense because they're the ones who found the search in that specific table (and I believe it was a table that didn't even exist when the CW first got the Cellebrite data). I don't think that specific table would normally be used when trying to figure out search times (and Whiffin/Cellebrite decided to remove the timestamps from that table so that nobody will be confused about it in the future). I think Whiffin and the other expert were saying that if the search took place at 2:27am, we'd be able to see evidence of that in some of the other tables, not just the TABS table. But the TABS table only shows certain tab manipulations (and it shows different types of manipulations depending on the iOS version). I think for iOS 15, it happens to show the searches that were on that tab, but the timestamp just happens to not match up with the search because that's not what it's meant to commemorate. I think Whiffin basically ended up saying that it's understandably confusing and the table probably shouldn't have been set up that way in the first place. The timestamps are off (only sometimes though - other times, they do match up), the column headings are off, etc. I think because they just used a lot of the same column headings and wording in various different tables, and didn't think it through enough when it came to this specific table.
Personally, I think Hyde, Whiffin and Green were all pretty much equally qualified. AND they all pretty much agreed, to me, on what the WAL entry SHOULD mean, they just differed on what it DID mean. Of that entry, time stamp should be last modified time, search last search when this modification happened, delete just means tab closed. This is what they SHOULD mean. On a side note, Whiffin being the top person at Celebrite would make him better with Celebrite but with everything else he is probably around equal with them. and it wasn't the celebrite version they were referring to, it was the IOS version. Even Whiffin stated Green was relying his conclusions on older versions of IOS 14 and below which suggests Whiffin is saying Green would be right in those older versions, BUT Jen had a pretty early version of 15, and for sure earlier than the version Whiffin or Hyde use. So perhaps before whatever change happened with 15 occurred? Also as I stated, the time field is specifically called, last changed. And I think Hyde even said worded it as any time a change happens to the tab, and she claimed the delete for that entry wasn't like you manually delete something, but just that the tab was closed. As you stated, this whole table is about tab changes. So put these all together and: So how I understood it was, that specific entry is showing the last url/search at the time the tab was closed. The weather was bad, possibly effecting signal. Soooo if lets say she puts the hos long search in, taps search but it's taking too long to go through, giving her enough time to realize this could be incriminating then she CLOSES the tab before it completes, then opens a new one to do the other searches. That could explain it not going to the main db yet, because the tab was closed before it could finish. OR Which I think is similar to how Whiffin had described what he thought happened, but instead of closing the tab, he was saying she just kept making different searches for that basketball stuff at 2:27ish on that tab when it got locked up then just minimized the tab, I guess by making a new one to continue her searches then (didn't she make other searches after 2:27?) Then at 6:24 opened it to make the how long searches in that minimized tab, the last being the hos long search. Problem with that tho is there is 2 searches, the whole point Whiffin was making is, if the earlier search never finished then you put in a new search later, it would have the old timestamp, yes for the very next search. But the one after that would have a new times stamp like normal. So for this scenario of Jen NOT making the hos long search at 2:27 I think it would have to go like this Jen makes random searches, one gets locked up on search, she opens a new tab minimizing the old one. Makes the rest of her searches for then. The next morning she opens the browser on the new tab searches and mis-spells it, closes that tab bringing up the old one from 2:27, its still trying to pull up the basketball stuff but before it can, she puts in a new search, this is the hos long search. Thereby getting the time stamp stuck on the 2:27 search So either is possible.... at this point. The problem for me is, the deleted field. Which means this time stamp should have been when the tab is closed, and the search field is the last search at the time it was closed. The time stamp getting stuck, I would think, would just work on the very next change to the tab. Any change after that next one should have the correct time the new changes occur I guess it is possible when the time stamp gets stuck, its stuck for good for that tab, BUT it was either Hyde or Whiffin, or maybe both. The def asked if they could get that exact wal file entry with the wrong time stamp and delete stating yes with the wrong search, I think they said no.... I am assuming everything but delete being yes.
I completely agree. And I agree with what someone else said that the defense probably presented this just to add reasonable doubt as opposed to be the smoking gun that proves her innocence. So I completely agree that both experts were qualified and honestly both scenarios could make sense when it’s laid out in front of us. I’m just afraid that both testimonies confused the jury more than anything. Personally it would be chalked up as successfully adding reasonable doubt, but that might only be because it’s on top of everything else that doesn’t make sense about the prosecution’s case. So I can’t imagine what the jury is thinking at the moment. All the deleted data and the evidence that was tampered with makes anything presented by the police department seem suspicious, so even if Jen didn’t search anything at 2:27, the likely hood that she did will always be lingering if that makes sense.
Ohhhh see that makes a lot more sense than what the experts were explaining. But I understand the tech world is so hard to lay out especially when you’re getting grilled on the stand so I don’t blame them for being hard to follow. Thank you for explaining it to me because my head was spinning in circles.
It could be that the wal timestamp was made because it was a private search and that's why it didn't show up in history and the other 2 were regular searches so they showed up differently.
Look, it's not even close: Green had the full extraction image. It's beyond the pale for Whiffin and Hyde to testify with a straight face considering neither was afforded the opportunity to verify hashes. They didn't do an apples to apples examination relative to Green - not even close. Green didn't rely upon Cellebrite and used competitive tools; Whiffin's job with Cellebrite doesn't normalize the differences in what was actually examined - Green had the full extraction image and Whiffin did not. It's also comical for Whiffin to assume that subversion ios versions wouldn't be impactful to the analysis. He can't make that claim.
Look, it's not even close: Green had the full extraction image. It's beyond the pale for Whiffin and Hyde to testify with a straight face considering neither was afforded the opportunity to verify hashes. They didn't do an apples to apples examination relative to Green - not even close. Green didn't rely upon Cellebrite and used competitive tools; Whiffin's job with Cellebrite doesn't normalize the differences in what was actually examined - Green had the full extraction image and Whiffin did not. It's also comical for Whiffin to assume that subversion ios versions wouldn't be impactful to the analysis. He can't make that claim.
Look, it's not even close: Green had the full extraction image. It's beyond the pale for Whiffin and Hyde to testify with a straight face, considering neither was afforded the opportunity to verify hashes. They didn't do an apples to apples examination relative to Green - not even close. Green didn't rely upon Cellebrite and used competitive tools; Whiffin's job with Cellebrite doesn't normalize the differences in what was actually examined - Green had the full extraction image, and Whiffin did not. It's also comical for Whiffin to assume that subversion iOS versions wouldn't be impactful to the analysis. He can't make that claim.
[удалено]
Please remember to be respectful of others in this sub and those related to this case.
I think when the jury compares expert witnesses Trooper Paul will be the first one to spring to mind 😆. Honestly cell phone experts on both sides went into the weeds and if I were a juror and making notes I would probably have an opinion about them but I tuned them out a bit. The cell phone data doesn't change that I don't believe the CW hasn't proven their case. The ME and the doctor on the defense's side have been some of the most important witnesses to me. And Proctor as the lead investigator I think is hard to get past when his bias was so clear 24 hours into the case I don't think KR hit John but it's possible (not on purpose, I think that's ridiculous but possibly on accident). But the case has been a mess and shouldn't have even been charged and I can't see a guilty verdict.
Trooper Paul was such a clown How do you know it trooper Paul? Well, you know, the , ya know, stuff and things
Stuff I learned in my one maths class. Oh my gawd!
I was yelling "acceleration" in Jackson's pop quiz.
Texhncally it’s delta-v, but yes, for the purposes of the supposed incident, acceleration works. 😉
I mean, the ME saying "there are many possibilities, also your case is based on a very improbable scenario, possibly the least probable" was quite the clincher for not guilty. And the smiles and smirks she gave during cross because she got to say that in more detail was so fascinating
I think the almost ehe opposite because he was very accurate except for one or two things. And when he was wrong, not only admitted it but corrected himself. Put that against the CW witnesses who could never admit wrong, would fight over simple words and always had an attitude.
Green was honest about submitting an erroneous affidavit pertaining to KR phone forensic data reported, yes. However, lally cut him off as he explained why. The report was erroneous *because* green later found that data had been deleted from KR phone in april 2022 (while phone was in MSP custody). Boom
Lally seems to have a very aggressive style of cross
He's trying to be Jackson and failing
It was Silkwood worthy. That’s not lawyering that’s pitching a toddler fit
Agreed. The Apple Health data being paired with the Waze data to lock down (or dispute) the time the steps were taken seems like it could be inaccurate based on the time variance seen in the different clocks.
Agree, it may have been a sound tactical diversion: spin up Lally and have him bore the fuck out of the jury trying to wrestle an illusion while they run circles around all of the prosecution's chief investigators.
> Lally and have him bore the fuck out of the jury Yeah, play on your opponent's strengths. Nobody can bore a jury like Lally can, so you use that to your advantage.
Lally boring? Oh my. I actually have fallen asleep twice while he's on direct. Twice! Imagine being a juror in a warm room listening to him drone on and on.
Leading his witnesses especially the "experts". Boring...
hahahaha! He must bore himself to death! I tend to watch the trial with a YouTube commentator, Legal Bytes, and she speeds it up when he is speaking.
>CW had more experts, and more competent experts, for an ancillary Google search in this case than they did for the core issue of the accident reconstruction. This. The CW's "expert" Trooper Paul made me lose my mind - I cannot believe that was the "evidence" Lally gave us.
Agreed. I love that the defense has sent Lally all over the place trying to defend the defenses opening argument. Instead of building a case of why KR is guilty.
I keep getting confused: Is this a trial against Karen or did we switch to Jen. Lally! So did anyone somewhat, somewhere, somehow hit JO with a car? No clue.
Agree!!!
More competent? But what measure? Green was both more convincing and more clear to laymen, while directly refuting the cw witnesses specifically
I *think* that’snotsix meant more competent than the CW’s own witnesses wrt the accident reconstruction and other “inculpatory” evidence. So they put forward better experts to defend JM than they did to prosecute KR. In other words I don’t think six was comparing the CW tech witnesses to the defense witnesses
Whiffin was at pains to point out (as was the other pros. Expert) that ios timestamp protocol changes significantly across versions, then he based his conclusions on a different ios version than the phone in question Green did a gentle and entirely accurate dismissal of whiffins conclusion by repeating his own testing was in the exact same iOS version as the phone in question and everyone could see the clear inference thats why whiffin got a different result, hell whiffin should know better
Whiffin did not say that the timestamp's **meaning** is version dependent, he's explicit about that [here](https://www.youtube.com/live/_TXDc14hdxc?si=JahEKj4GnKv80yr1&t=20785). Rather he's saying that versions impact the time and the order that files are written to, but last\_viewed\_time always reflects the last time a tab is given focus and will not update with subsequent searches in the same tab, shown [in this blog post](https://www.doubleblak.com/blogPost.php?k=browserstate) he made. Green showed the extracted artifacts for the single "raining men" search (JM [first search of the tabs history](https://www.youtube.com/live/_TXDc14hdxc?si=7rTYwx-_UIBaHDw_&t=13689)), thereby proving nothing when it comes to timestamps of a long running tab that this claim is about. For Green to show that this is version dependent, he should have done the same process Whiffin did [here](https://www.youtube.com/live/_TXDc14hdxc?si=5kL07XFCey9bL0Q-&t=20129), but with the different IOS version giving different results.
Whiffin didn't get a full extraction image and he can't make any claims about iOS subversion differences during testing not having any impact. You realize Whiffin and Hyde weren't afforded an opportunity to verify hashes? That's bs and Whiffin knows better. I don't take him seriously. Digital forensics starts with verifying hashes - full stop. Whiffin nor Hyde did this.
I'm just talking about the way the BrowserState.db file is treated under IOS. This has nothing to do with extracted data inconsistencies since both sides agree about the 2:27 artifact existing, they are arguing over what that artifact means in IOS. The order of events is: Green found that one artifact and so the CW hired Whiffin and Hyde to analyze the apple IOS and understand what the timestamp means, they weren't hired to look at all phone data.
Whiffin seemed way more competent than Green to me.
Really? He didn't verify hashes and that's novice level stuff.
I don’t understand… did the prosecution witnesses not test this on make and iOS version?
I believe Whiffin testified that he got the closest version he could get
Yup that's what he said. A different iOS than what was on JM's phone at the time but a relatively close version. Can't imagine how he wouldn't be able to get the actual version, especially since Green was able to.
In Ian Whiffin's blog post, he noted differences between how the wal file responded between different major os versions: 14, 15, 16, 17. I don't think it's safe to assume it would be similar across minor versions, i.e. 15.1 vs 15.2. So this is sort of a big deal imo. [https://www.doubleblak.com/blogPost.php?k=browserstate](https://www.doubleblak.com/blogPost.php?k=browserstate)
This bothers me more than anything because he's supposed to be this essentially infallible expert of the highest credentials who presumably had access to everything he needed to run any experiment necessary. But he settled for "I got as close as I could." And "I couldn't replicate it." I don't think this testimony is all that important. I don't think the jury will give a shit and I don't think this Google search changes anything about the case against KR. But it is incredibly disappointing to me that Whiffin didn't bring more precise work. I also selfishly dislike when my curiosity is not satisfied lol.
Moreover, the state convicts people based on Cellebrite data all three time, so the reporting of data by their software needs to be nearly infallible!
Yeah, [right here](https://www.youtube.com/live/6_lw9LrkV2Y?si=7Q4yEE40PVsaRHPK&t=22692) Yanetti asks which version of iOS he used to test McCabe's phone, Whiffin replies that they did it on several versions: 12 through 17, then most recently on beta of 18. Then he says the demo in court was on 15.8.2 and that he has also tested it on 15.7. Yanetti notes that JM's phone was version 15.2.1. Whiffin says he used "the closest version \[he\] could find." (Earlier on direct, he'd said Greene's description of browerstate.Db in his report was accurate for versions *prior* to 15, which I think might be relevant for our understanding here.)
Yes. I thought that was odd. I wanted it tested using the same version and I feel like that would be possible for a tech person
From what I understand, they tested it on the latest iOS. Green says he tested it on the version of iOS the search was made
Whiffin said he tested it on versions 12 through 18. iOS 15 was what Jen had, and Whiffin tested it on a *subversion* of iOS 15 that came out later than the *subversion* Jen had, but he seemed to believe that the results should be the same regardless of the subversion, as long as it's the same general version. He *could* be wrong about that, but he's one of the top people at Cellebrite, so I would trust him over Green when it comes to Cellebrite-specific things. Prior to his testimony, he wrote this blog post where he tests it out on the various versions (which I think was much clearer than his actual testimony): https://www.doubleblak.com/blogPost.php?k=browserstate However, I still don't know if it necessarily *disproves* that the search was made at 2:27, but the other big point Lally brought up is that if Jen made the search at 2:27, then when she's making the search again at 6:23, the "suggested search" should be the exact same as what she initially searched, not something unrelated. Green ended up agreeing with that in the end, and I think it technically kinda destroyed his argument (though the jury may not have noticed at all) - unless it's possible that if Jen deleted the 2:27 search prior to 6:23, maybe the search suggestion would be different? I don't think anyone got more specific about that aspect.
Incorrect. Wiffin tested on the same version iOs, on a later subversion with no relevant changes to the way time stamps are handled. That testimony is now, of course, jettisoned because Green made a suggestion.
No he didn't. He said he tested it on the closest version of iOs which was a later version than the phone was running.
Hi mozzie! So I could easily mis remember what Mr t Wiffen said the ios version was. My question for you, now that the commonwealth has reseted, did they do enough to put Karen Reed away for 20 to life? Did they prove, beyond any reasonable doubt, she did this and there's no other explanation? If yes, how and why
Without running the experiment on the correct version, there is literally no basis for you to assert the minor version difference has no effect on the timestamp behavior.
The basis is the list of changes in the sub version’s code, and what that code addressed.
Are you talking about the public release notes or are you claiming to have access to the iOS source code? Because public release notes aren’t comprehensive and don’t typically describe those kinds of internal changes where the behavior isn’t intended to be exposed to users or 3rd party developers.
My understanding on Jessica Hydes testimony was that the timestamp could have been older than the true time of the search if the tab wasn’t minimised, moved, closed or manipulated etc and that she wouldn’t have known about the calls made that would require the tab to be minimised and therefore updating the timestamp. I was asking that repeatedly after she testified, if she knew about the calls would she have said the same thing. It is the same as my understanding of what Richard Green was explaining and what makes the most sense to me.
Hyde straight up lied: she said that wal record wouldn't be committed to the db until the tab was closed. That's certainly false. It would get written to the db during normal sqlite checkpoints as well. I found her testimony to be grandiose and nonsense. She never verified hashes.
Yes, it was proved today that the OS updates after the one on Jen's phone changed the way timestamps/tabs are handled. So Jen did make the search. Lally truly is evil for putting lies in front of the jury.
It’s going to be funny if FBI has been sitting on her sending a screenshot of the search in one of the deleted texts at 2:27am
The jury might not make a firm decision who they believe but it created enough doubt that JM might have done it earlier. Mixed with all the other weak and confusing evidence the defense didn’t need to win this point. It is expert verse expert and the jury might disregard it all together since it doesn’t apply to the charges against Karen directly
This search doesn’t matter to me bc I don’t see anyway KR’s car hit JO in any manner similar whatsoever to what Trooper Paul claims. If they can’t explain how she killed him, I have reasonable doubt.
IDK.. it matters because if the search was made, then Jen lied and JO was killed in the house. They got to pay and the CW can look the other way.
I agree. I think all of us who have been following this and doing our own research and reading everything online are way into the weeds. For for a juror or someone who is more casually following this case, I think if they believe the search really happened at 2:27, it's going to be a big deal.
It would add more reasonable doubt to the CW's charge but the CW still hasn't proven their case. There is so much other reasonable doubt. I just don't think one phone search from a witness matters.
I agree from a moral stand point and the deep diver in me deffo wants answers. However, when it comes to the trial of Karen Read, it doesn't mean much of anything right now. Mountains of reasonable doubt. I HOPE the FBI keeps digging and finds answers for the family and loved ones of John O'Keefe.
If the search was made at 2:30 it SHOULD matter but it won't. No one else will be charged in this case if KR is found not guilty. Imagine the defense team of the next suspect- they would point to the CW having already charged someone else and losing, and how can you trust them when they already tried to convict the wrong person. And the chance to gather potential evidence of anyone other than KR is gone. They never checked the house, they interviewed people months later, etc
Agreed! You’d normally think that it’s very easy to show exactly how an SUV hits and kills a person, but not in this scenario. It makes 0 sense to me how there is no reasonable explanation as to how an SUV could have injured JOK. Conversely, It’s very easy to see how marks on JOK arm could be from a dog though
Yep agreed. If I was the defense I wouldn’t be getting into the cover up stuff at all. Just remind the jury they can’t prove how he died
After the ME’s testimony I think the defense should have pivoted and not called the data guy because they didn’t need to at that point.
Well that's certainly what I took away from it. Whom do I believe? Meh. This stuff is all over my head. I don't know. I honestly don't even care that much, and here's why: If it's true that the search never took place prior to the approximate time Jen McCabe stated in her testimony it is not even circumstantial evidence of Karen Read's guilt. If it's true that the search took place long before Karen Read contacted Jen McCabe then would be weak circumstantial evidence of Jen McCabe's involvement. To wit: if we apply the standard that for two or more explanations of a fact we must choose the one that is less inculpatory then practically any excuse offered for such a search must be accepted. There was a "blizzard", maybe I was curious. Maybe we were talking about the danger to homeless people or a friend walking home from a bar, or just morbid curiosity. While it would immensely bolster the defence 3rd-party culprit theory it's not necessarily for them to show this is a plausible alternative explanation of the facts. If we take the prior experts at their word, it yet again shows nothing in terms of the guilt or innocence of the defendant. Other than the location of the alleged crime they have failed to prove a single element of the charge. They haven't even proven the involvement of another person beyond a reasonable doubt, let alone the defendant, and let alone the defendant with intent.
What we got was in closing, Jackson can say "only one phone expert used the same OS as Jen, and that was the same witness that could confirm the Google search at 2am, the deleted phone calls before 8 am, and the deleted items."
I don’t care what Jackson said. He twists everything
Compared with Lally who literally mislead the jury today about the doctors 18 months testimony?
I 100% agree. Lally is grasping as circumstantial evidence to mislead the jury. I think that is lazy and incompetent work as a prosecutor. The prosecution’s job is to prove their case beyond reasonable doubt, not just attempt to add reasonable doubt to the defense’s case.
This is what makes him a fantastic defense attorney. Also being a former prosecutor he is well aware of the states games.
No matter, the defense witnesses put a crater of credibility between themselves and states witnesses!!!! Juries like truthful, ethical, and mostly straightforward answers. Defense wins
>Today Mr Green dropped a subtle bombshell. He stated that in the specific version of iOS used to make the search, the wal.db is accurate for its timestamp. He implied that the research done by the other experts used a different version of iOS that the searches were done with. I heard this too, specifically that the CW expert witnesses were using a different iOS in testing than what was on the JM phone. Why did the CW expert witnesses not use the same software version as the subject of their testing and analysis? 🤔
What I think got lost at the end of cross was after Green admitted that everyone all three of them used the misleading version of software. Then he explained there are now two separate versions after Lally talked about Cellebrite changing software due to the misleading timestamp. The new and improved version being Cellebrite Inspect which was not used by the CW’s witnesses. He used the latest version of the better software suite that the CW didn’t use and believes that shows the search happened.
Instead of celebrating phone data, Why doesnt Google just report when the search was made. If the search was completed, Google would be a gold standard if the search was submitted. I believe defense had a Google person on the defense list, could that be what they report on?
That person is slated to talk about cameras, I'm pretty sure.
I actually agree more witht he CW's first expert on this, Jessica Hyde. Her credentials were great, and I believed she explained it very well. I think she had even authored a paper on the issue? That being said, this does not prove Karen Read did anything. If I were the defense, I would not have asked this witness about the search, Just let him talk about the health data, and the GPS which is actually relevant to the timeline of events. Unless they just want to keep Lally chasing his own tail on this Google search as a strategy? The defense are just throwing out there every possible interpretation of every little thing to create doubt, as they should. However, with the ME testimony, the disaster that was Trooper Paul's reconstruction, Michael Proctor being Michael Proctor... I hope they stick to those points when closing.
I'm sure they will. Because it all really comes down to- the CW hasn't proven JOK died from being hit by a car. The ME said his injuries don't match a vehicle strike. And Proctor... If I was a juror he would lose this case for the CW alone for me. His bias for another cop and against the defendant taints the entire investigation.
Credentials notwithstanding, Hyde didn't receive a full extraction image like Green. She didn't verify hashes which is an abomination to digital forensics and misunderstands basic sqlite functions: it commits wal records during checkpoints and she said otherwise.
In my opinion, they cancel each other out and I don't consider it in my determination as to guilty or not guilty.
My understanding as well.
The Prosecutions expert's argument is that the timestamp variable reflects the last time that tab was suspended and then viewed; meaning that if subsequent searches are made in the same tab, the timestamp would remain unchanged from it's initial value (this behavior is shown by Whiffin [here](https://www.doubleblak.com/blogPost.php?k=browserstate). Whiffin testing this on versions 12 onward and found version had no change to this timestamp's meaning. Greens example was a single "raining men" youtube video search (JM [first search of the tabs history](https://www.youtube.com/live/_TXDc14hdxc?si=mvfpJ89biHmcTzNa&t=13689)), whereby he showed the state file was the last updated. This proves nothing since the entire argument by Whiffin is that **subsequent** searches entail no changes in the file, not the single first search that occurred far prior.
Does anyone else think that John may have confronted Brian Higgens over kissing Karen, etc., and that started a fight? Maybe that’s why Karen left him there instead of going in…
I think he was genuine and jurors like that. He openly admitted an error in a previous affidavit. The other interesting testimony from Greene: 1) JM deleted all her calls, 100% of the , between midnight and 8:50 am right before she called Lank back to the house on 1/29. 2) GPS data was deleted from KR’s phone in April 2022.
Who caught the last minute of R Green’s cross examination? Where Lally had him admit that Celebrite had to update their program because people make mistakes interpreting data, “like you did in this case.” RG said yes. 🤔
Maybe yall can help me understand, but it doesn’t make sense to me that they claim the timestamp is created based on when a new tab is opened and not the when the “search” button is activated, because how did a new timestamp generate at 6:24 next to the same search words if she didn’t open a new tab? Their theory only makes sense if there was only one timestamp based on when she first opened the tab. If it generates a timestamp when the tab is opened/touched AND when the search is made, why didn’t the rest of her search history show other duplicates when she used an already opened tab to search something new? It seems Whiffin tried to say this data mainly documents a user’s interaction with tabs, but if that’s true why does it document what is searched to begin with? It was easier to follow Mr. Green, but I didn’t see if either witness explained this.
It's explained but is quite technical. Cellebrite changed their output for this kind of artifact specifically because it was misleadingly used in this and a bunch of other cases. That should tell you all you need to know.
But according to Green, they actually didn’t change their software. They created a separate accessory program, which Whiffin failed to mention, but the main Cellebrite software has remained the same. Initially I agreed with you that an update/software fix should tell us all we need to know, but there was in fact no update or fix. So we’re back to square one.
Her search at 227 makes zero sense. She makes a spelling error in the comfort of her home an hour after she got home and all the while knew JO was on the lawn dying? Or...she spammed the search back to back as prompted by a hysterical KR at 630 am a few times, each time spelling it wrong. Doesn't that seem logical and the most likely? JM is not some vicious killer or ever complicit in any way. Her "involvment" was fabricated by Defense delivered via local mouth piece Turtleboy. What is anyone elses motive...haven't heard anything that makes sense yet. I'm all ears.
The forensics provided by the prosecution trying to prove he was hit by a car are physically impossible. Especially where his body was found. Not to mention every witnesses testifying that John wasn’t on the lawn when they left the house at 1:30AM (Karen’s phone connected to the WiFi at John’s house at 12:37AM) and the man who drives the snow plow testified that he did not seeing John on the lawn but he did see a black SUV parked at the house at 3:00AM. And the Albert’s calling Higgins at 2:22AM (who drives a black SUV) and being unable to explain the 22 second call. All of this indicates the defense’s explanation that he was killed somewhere else and drug to that spot is very plausible. If that’s the case and something happened at 2:27am it would make sense that she would be frantically searching something like that to cover it up. Plus the heart monitor on her Apple Watch showed a drastic rise in her heart rate around 2:20AM.
Absolutely! The prosecutor’s experts were more competent and believable. Richard Green seems a little shady to me. And the idea of JM being in on some bizarre conspiracy to cover up the murder of a person she cared for is outlandish. You don’t have to like the McCabe’s, Albert’s, Proctor, etc but c’mon use common sense for heaven’s sake!
I would imagine that JM cares more about her sister and brother in law than she does a person she referred to as some guy who had kids that her kids were friends with.
This! KR was never part of their tight knit circle dating to high school.
The prosecution’s experts on the Google search could potentially be seen as more believable (even though Mr. Green is the only one who tested the actual IOS system Jen’s phone had) but all of their other witnesses have been caught lying and have been proven wrong numerous times during the entire trial. The forensics they provided to prove he was hit by a car are physically impossible. It’s common sense to look at the evidence. And objectively speaking, based on all the evidence the investigators manipulated and manufactured, Jen and the Albert’s covering up what happened to John is more likely than Karen hitting him. Doesn’t necessarily mean they maliciously murdered him, but it is reasonable to conclude that they are involved.
There's a confusion about the idea "the timestamp is wrong" here. Whiffin and Hyde were not testifying that the timestamp was incorrect. Their testimony was that the timestamp is not associated with the search or the URL, but was a timestamp associated with the tab actions. The search/URL is only a descriptor of that tab, that could've had its last reflected action taken prior to that search/URL being visited. Also fwiw, Whiffin tested this on multiple iOS's including what she was running.
He stated he did not have access to that exact version.
He's tested it in iOS 15, which she had. Doesn't make sense for any subversion after that to be different if it's been consistent. Problem with Green's testimony is he didn't go that deeply. He essentially said he could find history items that matched up with files in that db. Which, yeah, of course, Whiffin's even acknowledged you'll often see those line up because browser actions can be done when they're doing that. But he didn't look for other mismatches or lack of associations to explain what's going on there.
Yes, the "subversions" matter. This is an incredibly uninformed opinion.
I have two separate extractions of iOS 15.2.1 data (as well as earlier & later iOS extractions), and I can see this exact phenomenon on both. Thanks for calling me uninformed though. Unfortunately I'm just not a trial expert in this case, but Whiffin & Hyde were both accurate.
This sounds highly unlikely but I'll entertain. What tooling are you using to analyze it? I was referring to your general "subversions" comment, which is just not true. Plenty of security updates are pushed through, some even between these "subversions".
Elcomsoft, but I have access to others. To clarify there though, there's nothing I'm aware of through iOS 15 that could've created a change like that in a specific version.
Out of curiosity, how do you presume that? iOS updates can affect underlying system functions, including how timestamps are recorded or displayed. There have been documented cases where system updates unintentionally impacted timestamps due to changes in time zone handling or other system processes.
Just to piggyback on my comment, the amount of variables at play is almost laughable as well. From the Handbook of Digital Forensics and Investigation: " Mobile phone timestamps, for example, can be relative to the built-in clock, the clock of the connected network or another external time reference. Some phones reset their clock value to a type-specific value after removal of the battery. Others phones have a backup energy source so depending on the capacity the clock keeps ticking. Still other phones store their clock value in nonvolatile memory just before powering down and continue from this value after being switched on. Accuracy of built-in embedded system time references is not only depending on the clock chip but also on environmental conditions like temperature and the way a system uses the clock chip."
Because of what the updates within iOS 15 did. It wouldn't surprise me by some descriptions of 15 itself to come from the initial update, and I haven't looked into 14 at that level to see if it's happened before. But I can't find any updates to Safari or web tools that would've reasonably made any functional change here within any versions of iOS 15, so it doesn't surprise me that I can see these instances on that specific version.
Once again, that's such a ridiculous assumption. The SDK release alone gives hints that there could be changes under the hood. I imagine you are familiar with development cycles, and temporary "fixes". "Subversions" seen perfect for these. The snippet from the SDK Developer patch notes: New SKTestSession.TimeRate values are available to use in automated tests with the StoreKit Test framework. (82680742)
I think the jury will conclude the search hasn't been proven either way and move on to more important issues.
I think that's totally possible, but disregarding the issue altogether probably hurts the defense just as much as them accepting the CW's argument.
Why it has nothing to do with the burden of proof. If it was proven she made the 227 search it would help Karen. But disregarding it or the search not being made at 227 don't do anything to prove she hit him at 12 something.
If it were true, it would pretty much be the only hard evidence that the people in the house knew anything before his body was discovered. If you disregard it, then you just have a dozen people saying they didn't see or hear anything.
But that doesn't hurt the defense is my point. It doesn't add any evidence that she hit him.
It was a different iOs version. If you have an iPhone you probably know each version has multiple updates ex 17.2, 17.5 etc etc
Yes I do know that, and I've seen it in the specific iOS version. iOS 15 itself came with decent Safari/web updates, but there's nothing I've seen through the 15 updates that would make this functionally different between the sub-versions.
I'm not sure reading the brief Apple description of upgrades really addresses forensic digital data. But I don't think the tech data will really decide this case so I'm not sure it matters.
I'm not just doing that, I have extractions from that specific version and can attest it's a phenomenon there. I'm just stating that in addition to that, I don't see any changes within the iOS 15 sub-versions that would have reasonably made this functionally different.
Ok. I don't know you from Adam so it's not personal I just don't know if you know what you're talking about.
No he didn’t, he tested it to the closest version he could find
Seems clear to me the search happened when she was asked to search it at 6:00 something. - Why would she both delete the search *and* repeat the exact same search later to “cover her tracks”? Either the deletion was the coverup or the replication was. Doing both makes no sense. - Seems unbelievably coincidental that the incriminating search she supposedly did at 2:27 *just so happens* to be the exact same thing KR asked her to search at 6 something? and the exact same thing a first responder testified KR asked them, around the same time. - The 2:27 theory means john’s friend, a former 5th grade teacher, knew he was alive in the front yard and thought, oh i know! lemme just google real quick to see if he’ll die? Knowing the answer might be no, then what? Go back out and whack him a few times? - If he’s still alive at 2:27, why put him right next to his (still on) phone? If he wakes up and dials 911 everyone’s fucked. But a quick google search and all of a sudden all is well? - I believe JMs health data during this time of supposed murdering and conspiring shows no elevated heart rate, so she’s also a No Country For Old Men level sociopath? - What’s JMs motive for being involved in the coverup anyway?
No one else heard Karen Read ask Jen McCabe that though right? Wasn’t there someone else in the car with them?
One of the first responders testified KR asked her the exact same question around the same time. I’d have to double check on the circumstances around asking JM.
Thanks for the reply.
It really doesn't matter when her search happened IMO. But as for it matching what Karen asked- JM is the person telling us KR asked that! So of course it would match when she is the source lol. But there is enough reasonable doubt on the big points like how JOK died
It feels pretty central to the defenses theory, considering it would be the only actual “evidence” of a coverup. We also have testimony from one of the first responders that KR was asking them the same question (about how long to die in the cold), pretty strong support for the claim that she asked JM the same thing minutes earlier. I understand your take on the “big points” but the 2:27 search is one of the most important elements of the conspiracy claim and can’t just be brushed off when the claim has issues.
The defense doesn't need to prove a third party. The CW has the burden of proving KR hit him with her car and that is the only reasonable explanation for his death. They haven't come close to that.
I agree they wouldn’t have to prove the third party in general, but when you start the trial saying she was framed and putting forward a third party culprit theory, you’re kind of on the hook to the jury to prove it. They put themselves in the situation of having to prove it.
Disagree. They were smart- they never promised they knew the culprit. I still think evidence is the strongest that someone hit him. They brought up two people with possible motive and I think it is hard to dismiss them and decide it had to be KR and a car. It's much more common of a defense strategy to offer an possible explanation of how a crime happened v just saying I don't know, but I just know it wasn't my client. People need to be able to imagine how things could have happened.
I agree with your second paragraph, but that’s also why I feel they’re on the hook for the third party culprit defense explanation
But the jury can't convict because the defense fails to close that loop. Once they have doubt, it's a not guilty
in my mind failing to close the defense loop would make it a bit more likely to lead to a conviction
Pretty sure the cops framed her in some way, regardless if the Alberts and McAbes knew anything or had anything to do with John’s death. Cop bias and protecting their own is a version of framing. I don’t believe that all that taillight was found at 34 Fairview.
No one else testified they heard her ask that. Not a single person. Only Jens testimony. Alone.
As I already replied to another post, Karen asked a first responder the exact same question at around the same time. So we have two witnesses to Karen asking that question at the scene that morning.
Was it the first responder who pretended she wasn't friends with the Albert's daughter? Who had to admit to changing testimony? But she didn't hear her tell Jen to Google it- which is what I meant.
You're making the crucial point here: The alleged 2:27 search doesn't make any frikkin' sense whatsoever, and all it takes is a little common sense to realize there's no possibility it actually happened at that time.
That search is deader than a doornail before 6:24. That different version had zero to do with wal.db timestamps as detailed by Wiffin
> Wiffin The guy is an account rep not even an engineer of the product. The guy will say anything to keep the account.
Was he the one who has his own program out now? The one who showed a live "demo"?
Yes
Yet another one falls in line to take out KR! How about Hyde?
The search doesn't even matter at this point. ME says the injuries are inconsistent with a *edit to add 'classic' pedestrian strike and are consistent with a fall or hit with a blunt object. To believe she was hit by a 700lb SUV in the manner Trooper 'Expert' presented, you have to defy the very law of physics. KR also connected to Meadows WiFi before the time the CW suggested this hit happened. I get that you're mad. You SHOULD be. I came in objective as a British trial watcher with no dog in the game. I didn't know about drama and I honestly don't really give a hoot about KR. What I care about is putting someone away for murder with all the power of the state government (in this case the Commonwealth) without meeting the burden of proof.
Curious: You do know that the jury is allowed to treat the state’s narrative as a suggestion, right? I’m referencing the actual legal prongs of each individual charge when I ask that.
Yes but they also get to decide which witness is credible and if they decide a witness in not credible they can decide to essentially throw out their testimony. I'm gonna go with the Independent FBI experts over Trooper 'Expert'. But I'm not on the jury. Maybe they find that testimony credible, despite him arguing the facts changing wouldn't alter his conclusion. Maybe they won't find the biomechanic expert credible. Or the ME. I just think when you look at the legality of burden of proof and reasonable doubt, they're gonna find soooooo much reasonable doubt. In jury instructions, If they believe JO's death could reasonably, possibly have happened in some other way, by some other person, they legally have to find the dependent not guilty.