Parsing the Truth: One Byte at a Time

A single Google search. A disputed timestamp. And a murder trial that ended in a mistrial.
In the high-profile Karen Read case, competing digital forensics experts offered contradictory testimony about when a key witness searched “hos long to die in cold” on an iPhone. But let’s take a step back and first review the affidavit that started it all.
This session breaks down defense expert Richard Green’s affidavit that challenged the prosecution’s narrative and ultimately won Karen Read access to additional evidence. We’ll discuss the specific artifacts Green analyzed, why context matters, and how no digital evidence artifact stands alone.
This is Episode 1 of our deep dive into the 2024 Karen Read trial.

Digital Forensics Tool mentioned:
Magnet Axiom
Cellebrite

Digital Forensics Artifacts mentioned:
KnowledgeC.db
callhistory.storedata
com.apple.mobilesafari.plist
browser state.db
Key Terms:
Hos long to die in cold
How long ti die in cikd

Links:
Richard Green Affidavit
https://assets.super.so/669329c3-e11b-4cc8-9a05-1c7f310ff348/files/80f46306-87ad-41c2-a85a-138a816e44b6/Affidavit_of_Richard_Green_in_Support_of_Defendants_Motion_for_Order_Pursuant_to_MASS._R._CRIM._P._17_Directed_to_Brian_Albert_Verizon_and_ATT.pdf
Defense Motion
https://elderlaw.info/wp-content/uploads/2023/09/sj-2023-0343-petition.pdf

We're starting our series on the 2024 Karen Read trial. We're digging into the testimony given by digital forensic examiners. In this episode, we're going to preview what we've got in store for you.

What will the facts and artifacts reveal? Tune in every Thursday to find out!

Did Leslie Hartman commit suicide, or was it murder? Did her boyfriend, a sheriff's deputy, murder her, or just make the 911 call? Find out how ChromeCache and trace evidence from Discord helped solve the case.
Mario Merendon joins us this week to walk us through his role in this case. Mario emphasizes the importance of curiosity, validation, and inter-agency collaboration in digital forensic work. His careful testing and validation of timestamps, web cache data, and chat logs made the difference in solving this complex case. Special Guest: Mario Merendon of VX Digital Defense
Find Mario at https://www.vxdigitaldefense.com/

Digital Forensics Tools Mentioned in this Episode:
Magnet Forensics Axiom
ChromeCache
Dcode

Digital Platforms Mentioned in this Episode:
Discord
Key Topics from this Episode:
The importance of verifying digital evidence beyond default tool outputs
Utilizing open-source tools like ChromeCache View to dig deeper into web and application caches
Correlating timestamps from images, chats, and web activity to build a timeline
Challenges and solutions in extracting data from wiped phones and encrypted devices
The significance of validation and testing in building a credible digital case
Collaboration strategies with law enforcement and prosecutors to strengthen findings
Lessons learned: curiosity, thorough documentation, and validation as core to successful forensics

Last week, we had lots of questions about those printed emails. So we brought on Lauren Hillery, who saw all the emails, to give us the inside scoop.

Lauren shares the defense's strategy with regards to the emails, the authentication issues, and tells us more about hiring a digital forensic examiner as a public defender.

This is Part 2 only. Go back and listen to Part 1 in S1 E38
https://open.spotify.com/episode/3Xpa2gtG0fYI73sQV8Y37V?si=3vk-s0JQS0m3xPU0EW39Cg

Special Guest: Public Defender Lauren Hillery

Data Sources Mentioned in This Episode:
Twitter
Gmail
Email
iPhone

Sixty printed emails. Partial evidence. Incomplete story. Learn how digital forensics can fill the gaps in this real-world case.

Episode Summary:
This week, Becky and Stacy explore a case where printed emails became the centerpiece of a legal trial. A mother and daughter presented 60 pages of printed emails, which were actually Twitter DM notifications, as evidence of a crime. Discussions include the complexities of email authentication, the potential for email spoofing, and why forensic examination is essential for verifying digital communications. Will the jury take the printed emails into consideration? Tune in, and find out.

Key Takeaways:
Digital evidence can be easily manipulated, making authentication crucial.
Email headers are vital for verifying the origin of messages.
Forensic examiners play a key role in legal cases involving digital evidence.
Printed emails lack the necessary metadata for authentication.
Email spoofing is a common technique used to forge messages.
Forensic tools can reveal discrepancies in email timestamps.
Legal teams must understand digital evidence to argue effectively in court.
The jury's understanding of digital evidence can impact trial outcomes.
Forensic examiners must communicate findings clearly to non-experts.
Digital evidence issues can determine the outcome of a case.