David Grubbs — Direct/Voir Dire
294 linesJUDGE NEWMAN: Call your next witness.
MR. CONRAD: The state calls David Grubbs.
The witness, DAVID GRUBBS, was first duly sworn and testified as follows:
COURT CLERK: Take a seat in the witness stand. If you, please state your name and spell your last name for the record.
DAVID GRUBBS: My name is David Grubbs, G-r-u-b-b-s.
VOIR DIRE EXAMINATION
BY MR. CONRAD:
MR. CONRAD: All right. Good afternoon, Mr. Grubbs.
DAVID GRUBBS: Good afternoon.
MR. CONRAD: Where are you employed, sir?
DAVID GRUBBS: I'm employed with the with South Carolina Attorney General's Office.
MR. CONRAD: All right, and what is your job title at the Attorney General's Office?
DAVID GRUBBS: I'm the chief forensic investigator for the Internet Crimes Against Children Task Force.
MR. CONRAD: All right, and just briefly let the jury know what the Internet Crimes Against Children Task Force does.
DAVID GRUBBS: So we assist agencies throughout the state, as well as have our own investigators. And we look into peer-to-peer downloads that go over the internet usually containing child pornography. And then we also do chat-ops throughout the state posing as minors to attract suspects. My unit specifically does the computer forensics for those cases.
MR. CONRAD: Okay. When you say forensics, you mean forensics -- cell phone forensics, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: So as part of your job duties, you perform cell phone downloads, extractions, and analyze them, correct?
DAVID GRUBBS: Correct.
MR. CONRAD: All right, and you've gone through a number of trainings in the past that's focused on that. Is that correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: Can you read for the jury your training in this area, please?
DAVID GRUBBS: So, I am a Cellebrite certified operator, and a Cellebrite certificate certified physical analyst. I'm a certified blacklight examiner, which both of those are cell phone data extraction tools. I'm certified in Forensic Explorer, which is used to analyze computers; Graphite Analyzed Training; Tego in the area of Magnet Forensics, which is -- Magnet makes the tool Axiom, which is one of our primary tools that we use. I've received advanced IOS in GrayKey training; advanced IOS examinations; Magnet Axiom advanced mobile forensics, Axiom based computer forensic examination; Axiom advanced computer forensics.
I'm also a member of the United States Secret Service Cyber Task Force, Cyber Fraud Task Force to be specific, which runs the National Computer Forensic Institute in Hoover, Alabama, where I've been sent to for basic network investigations; McIntosh Forensic Training Digital Investigation Supervisors Course; and I received an award in 2020 and 2021 being ranked in the top forensic examiners with the Secret Service. I've had training for the National White Collar Crime Center, which is the -- it's called NW3C, and basic data recovery and acquisition, intermediate data recovery and acquisition; basic cell phone investigation; cell phone interrogation; advanced wireless network investigations; GPS interrogation; Windows artifacts; social media; identifying and seizing electronic evidence, encryption, and legal concerns for digital evidence responders. I've also been to the SANS Institute on -- for multiple trainings for advanced network forensics and analysis, advanced digital forensics and incident response, hacker tools, technique, and exploits in incident handling. And I've taken a course with Texas A&M Engineering Service for information security. And then for other forensic softwares I have had Access Data boot camp, Access Data Mac forensics, in-case computer forensics. And in addition to that, pretty much every year, except for when Covid was going on, I will go to a National Training for Law Enforcement on Child Exploitation in Atlanta.
MR. CONRAD: All right. Thank you.
MR. CONRAD: At this time the State would move to enter Investigator Grubbs as an expert in cell phone forensics.
JUDGE NEWMAN: What says the defense?
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: So qualified.
DIRECT EXAMINATION
BY MR. CONRAD:
MR. CONRAD: And, Investigator Grubbs, there are three cell phones in evidence in this case and the data associated, you've analyzed some of it, haven't you?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: All right. Let's talk specifically about Paul's phone. To your knowledge, was that originally extracted by Jon VanHouten of the Secret Service?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: And then provided to -- that information provided to Lieutenant Britt Dove?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: All right, and you've received that cell phone information from him and you've analyzed it as well, correct?
DAVID GRUBBS: I did.
MR. CONRAD: Okay, and you were asked to focus on a couple of specific areas in your analysis of those -- of Paul's phone, correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: Okay, one of which was Paul's battery habits and battery usage on his cell phone, correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: All right. I'm going to show you what has been marked as State's Exhibit 530. Do you recognize that, sir?
DAVID GRUBBS: I do.
MR. CONRAD: What is that?
DAVID GRUBBS: That is a report that I generated concerning Paul's phone and battery and shutdown time with the phone.
MR. CONRAD: Okay, and you looked -- in the week prior to the murders, you looked at how many times Paul's phone had died because its battery ran out, correct?
DAVID GRUBBS: Correct.
MR. CONRAD: And you identified those times, right?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: Dates and times.
DAVID GRUBBS: Yes, sir.
MR. CONRAD: So, how many times that week did his phone die in total that week from the battery?
DAVID GRUBBS: Four.
MR. CONRAD: And what days were those on?
DAVID GRUBBS: It looks like June 3rd, twice on June 5th, and then on June 7th.
MR. CONRAD: And June 7th it died when?
DAVID GRUBBS: It is 22:34:24, or 10:34 p.m.
MR. CONRAD: So 10:34 p.m. Okay, and one of the pieces of information that cell phones log is when a phone is plugged back in after it's died to charge, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: All right, and when you looked at this data of when the phone died that week, Paul's phone died, did you identify when it was plugged in?
DAVID GRUBBS: I did, sir.
MR. CONRAD: All right, and can you just tell the jury on those two when the phone died each of those times and when it was plugged back in, please?
DAVID GRUBBS: Sure. So, it is logged that on June the 3rd at 12:30:27 p.m. The phone died, the battery went dead, and at 12:34:03 it had power again. It was reconnected.
MR. CONRAD: And I'm going to take that from you.
MR. CONRAD: And at this time the State would move Exhibit 530 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(CELL PHONE RECORDS MARKED AS STATE'S EXHIBIT NUMBER 530 WERE RECEIVED INTO EVIDENCE.)
(Break in proceedings.)
MR. CONRAD: Do you see anything on your screen up there? Oh, here it comes. Okay. So, do you -- zoom in a little bit. There we go. All right. So on June 3, 2021, what time did Paul's phone die?
DAVID GRUBBS: On the 3rd, 12:30:27.
MR. CONRAD: All right, and what time was it plugged in?
DAVID GRUBBS: 12:34:03.
MR. CONRAD: About 4 minutes later, correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: A little less than 4 minutes, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: June 5th, the first time, at what time did the phone die?
DAVID GRUBBS: 10:18:33.
MR. CONRAD: All right, and what time was it plugged back in?
DAVID GRUBBS: 10:36:17.
MR. CONRAD: So, it will be roughly 17 minutes or so?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: All right, and then June 5th, the second time, what time did it die?
DAVID GRUBBS: 21:23:21, 29 -- excuse me, or 9:23 p.m.
MR. CONRAD: Okay, and what time was it plugged back in?
DAVID GRUBBS: 21:30:21, or 9:30.
MR. CONRAD: So, roughly about 7 minutes later, correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: Okay. All right, and you just didn't focus on when Paul's phone died in the data review, correct?
DAVID GRUBBS: Correct.
MR. CONRAD: And did you find in what you reviewed, did Paul frequently let his battery get low?
DAVID GRUBBS: Yeah. He seemed to kind of fly close to the sun. The phone was always getting down to one to two percent before he would plug it in.
MR. CONRAD: And would you say in your opinion from the data reviewed that the majority of the time he let it get that low, would he ultimately get it plugged in before it died?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: Except during that week for those specific occasions, correct?
DAVID GRUBBS: Correct.
MR. CONRAD: All right, and one other thing you were asked to look at on Paul's phone were the times when his screen came on, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: And when it -- when it came off, correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: And that is sometimes referred to as the backlight on a phone, correct?
DAVID GRUBBS: Correct.
MR. CONRAD: All right, and you were specifically asked to look at the time on Paul's phone starting at about 8:49 p.m. on the night of June 7th, correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: All right, and I'm going show you what has been marked as State's 529. Take a look at that. And what are -- do you recognize that, sir?
DAVID GRUBBS: Yes, I created this.
MR. CONRAD: All right, and what is that?
DAVID GRUBBS: It shows the backlight for the phone when it's kind of going on and off throughout that night.
MR. CONRAD: For what time period?
DAVID GRUBBS: From the period of 8:49, and then the final time of 10:34.
MR. CONRAD: Okay.
MR. CONRAD: At this time, the State would move to enter Exhibit 529 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(CELL PHONE RECORDS MARKED AS STATE'S EXHIBIT NUMBER 529 WERE RECEIVED INTO EVIDENCE.)
MR. CONRAD: And let's, let's -- before we talk about this specific data, let's just -- the jury has heard some testimony on this screen backlight and the screen coming on. Under what conditions generally speaking would a cell phone screen on come on?
DAVID GRUBBS: There's a lot -- excuse me, there's a lot of conditions that will cause a cell phone screen to come up. If you pick up your phone, that can have the phone -- the screen turn on. If you get a message or an alert from an app that you have, that can cause the screen to turn on. If the phone senses motion in a particular way, it will turn on. There's a whole variety of ways that the backlight will activate.
MR. CONRAD: I think you mentioned this, but the screen can be tapped.
DAVID GRUBBS: Yes. You can simply tap your screen and that will cause it to turn on as well.
MR. CONRAD: And so just in a nutshell, the screen can come on for -- sometimes there's no human interaction, correct?
DAVID GRUBBS: Yes. Correct.
MR. CONRAD: But it also can be turned on by human interaction, correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: Okay. Let's look at the information on your report real quick. All right. Okay. So at 8:49 p.m., it looks like the screen goes off, correct --
DAVID GRUBBS: Correct.
MR. CONRAD: -- on Paul's phone. And what time does it get -- the next time that screen lights up?
DAVID GRUBBS: The next screen on is at 10:18:08 p.m.
MR. CONRAD: Okay, and in your review of Paul's phone, did you determine during that same timeframe starting at 8:49, was Paul's phone locked or unlocked?
DAVID GRUBBS: It was locked.
MR. CONRAD: Okay. So, it was locked and the screen was off between 8:49 and 10:18, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: And then at 10:18:08 we see the screen come on, correct?
DAVID GRUBBS: Yes. It appears to come on for 12 seconds at 10:18:20.
MR. CONRAD: Okay, and then the screen goes back off starting at what time?
DAVID GRUBBS: 10:18:20.
MR. CONRAD: Okay, and then it comes back on --
DAVID GRUBBS: At 10:20:08.
MR. CONRAD: All right. How long does it come on at 10:20:08?
DAVID GRUBBS: It goes until 10:20:20, so 12 seconds.
MR. CONRAD: 12 seconds? All right, and then what happens with his screen?
DAVID GRUBBS: It goes back off at 10:20:20.
MR. CONRAD: Okay, and it stays off until when?
DAVID GRUBBS: 10:34:16.
MR. CONRAD: And is that the time Paul's phone died?
DAVID GRUBBS: Yes.
MR. CONRAD: And so the screen may have come on briefly as the phone was shutting off?
DAVID GRUBBS: It looks like for 4 seconds.
MR. CONRAD: Okay. All right. In your review of Paul's phone, did you identify some of the communications that came into his phone?
DAVID GRUBBS: Yes, I did.
MR. CONRAD: And did you identify the last text that was sent to Paul's phone?
DAVID GRUBBS: Yes.
MR. CONRAD: And do you recall who sent that text?
DAVID GRUBBS: Rogan.
MR. CONRAD: All right, and you may not remember this exactly, but -- well, first of all, was that -- do you recall the contents of that very last text from Rogan?
DAVID GRUBBS: Yeah. It just says: Yo.
MR. CONRAD: All right, and did we've -- this jury has heard testimony that cell phones will log when someone actually reads a text, correct?
DAVID GRUBBS: They do.
MR. CONRAD: And did you find any log that that text yo was read?
DAVID GRUBBS: It was not read.
MR. CONRAD: Okay, and do you recall roughly the time that text hit Paul's phone?
DAVID GRUBBS: I don't off the top of my head.
MR. CONRAD: All right. Was it between 9:00 and 10:00 p.m.?
DAVID GRUBBS: Yes.
MR. CONRAD: Roughly speaking? Okay, and -- but that was the last text. No other text came to his phone after that text from Rogan that said yo.
DAVID GRUBBS: Correct.
MR. CONRAD: All right, and in your opinion, if anybody had been looking at that screen that came on at either 10:18:08 or at 10:20:08, would they have seen a notification on that screen?
DAVID GRUBBS: Most likely, yes. You can set your phone to not show contents, or sometimes if you have a text that comes through it will show the whole text and the content. It depends on how -- its setting, but yes, typically if you were to see the home screen on the phone, there would be the notification.
MR. CONRAD: All right, and so depending on the settings, it is -- there's a good chance if anybody happened to be looking at that phone screen at any of those times, they would have seen a noted miss -- a text notification from Rogan Gibson, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: Okay, and you just testified we don't know exactly why the screen came on at that time, correct?
DAVID GRUBBS: We do not.
MR. CONRAD: All right. It could have been somebody tapped it, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: Somebody may have briefly picked up the phone, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: It could have been any number of things, correct?
DAVID GRUBBS: Yeah, any number of things.
MR. CONRAD: All right, and you can't tell us exactly why.
DAVID GRUBBS: I cannot.
MR. CONRAD: Now, this jury has heard a good bit of testimony about phone orientation changes, and we'll talk a little bit more about that a minute. But in your opinion, is it possible for someone to just briefly pick up a phone, see the screen come, put it back down, and for the phone not to record an orientation change?
DAVID GRUBBS: Sure.
MR. CONRAD: Okay. Moving on. All right, and you were also asked to look at Maggie's phone, correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: All right, and specifically what database were you asked to take a look at on Maggie's phone?
DAVID GRUBBS: Knowledge C.
MR. CONRAD: The jury has heard some on KnowledgeC database, but just please refresh our memories what that is and what kind of information is contained in the KnowledgeC database on that phone.
DAVID GRUBBS: Sure. So, the KnowledgeC database is something that Apple uses in the background to kind of track things that you're doing. It tracks your battery level, it tracks when you plug your phone in and when you unplug it, a whole bunch of stuff that is going on in the background that typically people have no idea is even running.
MR. CONRAD: Okay, and -- okay. All sorts of information in that.
DAVID GRUBBS: All sorts of information.
MR. CONRAD: And is it -- would some folks be surprised if they saw the amount of information a phone is recording at any given time?
DAVID GRUBBS: It can hold millions of artifacts.
MR. CONRAD: Okay. I'm going to show you State's Exhibit 528 and ask if you recognize that, sir.
DAVID GRUBBS: Yes, sir.
MR. CONRAD: And have you reviewed the contents of that CD?
DAVID GRUBBS: I have. It's a digital copy of some timeline reports --
MR. CONRAD: Okay.
DAVID GRUBBS: -- from Maggie's phone.
MR. CONRAD: And specifically for Maggie's phone?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: All right, and that timeline report would be from the KnowledgeC database?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: All right, and specifically you said that a KnowledgeC database can contain millions of artifacts, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: When you prepared that timeline, did you kind of narrow it down a little bit to focus?
DAVID GRUBBS: Yes, I did.
MR. CONRAD: And roughly what times are on that?
DAVID GRUBBS: I believe from 8:00 to past 10:00.
MR. CONRAD: All right.
MR. CONRAD: And at this time, the State would move to enter Exhibit 528 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(CELL PHONE RECORDS MARKED AS STATE'S EXHIBIT NUMBER 528 WERE RECEIVED INTO EVIDENCE.)
MR. CONRAD: Can I have the computer, please?
(Break in proceedings.)
MR. CONRAD: Okay, I'm going to pull up this spreadsheet on the computer that's in evidence on the CD. Even with a fairly narrow timeframe, there's still a voluminous amount of data contained in this database. Is that correct?
DAVID GRUBBS: Lots of data, yes, sir.
MR. CONRAD: Okay. All right, and specifically let's -- first let's state the start time and end time. For this particular report, you're kind of limited between -- what's that start time, that first one there?
DAVID GRUBBS: 23:53, so 8:53 p.m.
MR. CONRAD: Okay. We'll scroll down to the bottom real quick. And it looks like it stops at what time?
DAVID GRUBBS: 21:08, so 9:08.
MR. CONRAD: 9:08 p.m.?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: On what date?
DAVID GRUBBS: That would be June 7th of 2021.
MR. CONRAD: All right, and there's just a whole bunch of stuff here, right?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: Well, let's take a look at a couple of things specifically. Excuse me. Starting at 20:53, we see some orientation changes, correct?
DAVID GRUBBS: Yes, sir.
MR. CONRAD: All right, and in your opinion, when you see an orientation change on a phone recorded in the KnowledgeC database, what does that information tell you?
DAVID GRUBBS: Typically that somebody is handling the phone.
MR. CONRAD: Okay. So while a screen coming on or off may not necessarily tell you somebody is handling a phone, the orientation change definitely does, correct?
DAVID GRUBBS: Yes. It's the phone logging that it's going from vertical or landscape to the other.
MR. CONRAD: Okay. All right. So, here -- let's look at line 1149, starting down to about 1154. Do you see what I'm talking about there --
DAVID GRUBBS: Yes, sir.
MR. CONRAD: -- these lines here? And it says camera. What -- in your review of this information, can you draw any conclusions about what's going on and why that camera pops up at about 8:54 in this database?
DAVID GRUBBS: All I can say is that the phone is interacting with the camera in some way.
MR. CONRAD: All right, and did it interact for a significant period of time?
DAVID GRUBBS: No, sir.
MR. CONRAD: Do you recall roughly how long that interaction took place?
DAVID GRUBBS: I believe it's 1 second.
MR. CONRAD: Okay. All right. Let's go down to line 1210; this is at 8:55, or 20:55. And we see some things that says IOS snapshots.
DAVID GRUBBS: Yes, sir.
MR. CONRAD: And there's a -- it looks like it says something about Facebook to the far right there, correct?
DAVID GRUBBS: Correct.
MR. CONRAD: What -- in your opinion, what's going on with the phone at this point?
DAVID GRUBBS: So a snapshot, or an IOS snapshot, is something that your phone does when you minimize an app in the background. So if you close Facebook and put it in the background, it takes little snapshot of it so when you pull it up, you can see what it is. It'll do this for -- as we see here, Facebook, which we can pull up and see, it does this for a budge of apps. Not all apps take a picture of it. Some things will be just be a blank screen. For example, if you do your camera, it's not going to store a picture of what your camera was looking at. When you have it, it's just a black screen.
MR. CONRAD: Okay, and so in your opinion, does this mean anybody is actually accessing the Facebook app or actually physically taking snapshots on this phone?
DAVID GRUBBS: No.
MR. CONRAD: All right. In fact, it's not doing that, correct?
DAVID GRUBBS: Correct.
MR. CONRAD: All right, and, in fact, in your review, this -- the timeframe on this report is 8:53 to approximately 9:08 p.m., correct?
DAVID GRUBBS: Yes.
MR. CONRAD: And during that time, in your review, was Maggie's phone locked or unlocked?
DAVID GRUBBS: It was locked.
MR. CONRAD: Okay, and it remained locked starting at what time? You may have to draw your memory, but this doesn't start until 8:53, but it's prior to 8:53, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: All right, and it remains locked until the next day, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: Okay. All right, and then we're going to scroll down starting at line 1243. I see a whole bunch of stuff here. And just generally speaking, what is all of this stuff in this database at this time?
DAVID GRUBBS: It's just background processes that your phone is running.
MR. CONRAD: Okay. I think we already skipped by it, so I'm just going to ask you real quick, but in this timeframe we also see it looks like the Siri App pop up in the KnowledgeC database, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: And how can the Siri App be triggered?
DAVID GRUBBS: It could be a background process that's going on, or it can be triggered by somebody holding the power button or interacting with Siri.
MR. CONRAD: Okay. All right.
JUDGE NEWMAN: Ladies and gentlemen, we're going to adjourn. We're going to adjourn at 5:15, so --
MR. CONRAD: I'll be done by then, Your Honor.
JUDGE NEWMAN: Okay.
MR. CONRAD: Okay. Well, the information that's in this log, but did you identify a time after 9:00 when Maggie's screen turned off?
DAVID GRUBBS: When her screen turned off?
MR. CONRAD: Yes.
DAVID GRUBBS: Yes.
MR. CONRAD: And was that at 9:07 p.m.?
DAVID GRUBBS: Yes.
MR. CONRAD: Okay, and after 9:07 p.m., did you identify at any point over the next few minutes -- or over the next 20 minutes that Maggie's screen turned on?
DAVID GRUBBS: I believe it turned back on at 9:31.
MR. CONRAD: Okay. So between 9:07 and 9:31, Maggie's screen is off, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: And also -- you just said this a minute ago. It's also locked during that time, correct?
DAVID GRUBBS: Yes.
MR. CONRAD: All right, and so if Maggie's phone were thrown between 9:07 and 9:31 and the screen is off and the phone is locked, in your opinion would you see an orientation change?
DAVID GRUBBS: No, sir. That version of the IOS that she had on her phone did not log that at that particular time.
MR. CONRAD: So that version, which was what at that time?
DAVID GRUBBS: 14.6.
MR. CONRAD: All right. In that version of IOS, if a screen is off and the phone is locked, the phone is not going to record an orientation change, correct?
DAVID GRUBBS: That is correct.
MR. CONRAD: Okay.
MR. CONRAD: No further questions, Your Honor.
JUDGE NEWMAN: All right, we're going to adjourn for the day, ladies and gentlemen, and resume at 9:30 in the morning.
(The jury left the courtroom.)
JUDGE NEWMAN: All right, if everyone will be seated. With regard to the Court's earlier ruling excluding the -- not allowing the roadside shooting incident during cross-examination, I find that the defense opened the door to all of that testimony by questioning the witness as to the relationship between Mr. Murdaugh and Eddie Smith: payment of money to buy drugs, indebtedness, the overall relationship. And in order to not mislead the jury and to the doctrine of completeness and fairness, the court reverses its decision and will allow the examination of witnesses regarding that relationship. And we'll be in recess until tomorrow morning at 9:30.
(Whereupon, the case was at ease.)