Skip to content
2023 Murder TrialtranscripttranscriptMicah Sturgis — Direct/Cross/Redirect/Recross/Voir Dire - Day 20 - 2023 Murder TrialDigital-forensics expert Micah Sturgis examined phone activity around 8:49 to 9:07 p.m., identified signs of handling and other events, and explained the limits of determining who used or moved Maggie Murdaugh’s phone.
John B. ConradCreighton WatersPhillip D. BarberDick HarpootlianClifton NewmanMicah SturgisJudge NewmanMr. BarberCourt ClerkMicah SturgisMr. ConradMr. WatersMr. Harpootlianvoir_diredirectcrossredirectrecross
2023 Murder Trial/Day 20/February 22, 2023
5 pages·5 witnesses·3,118 lines
Digital-forensics expert Micah Sturgis examined phone activity around 8:49 to 9:07 p.m., identified signs of handling and other events, and explained the limits of determining who used or moved Maggie Murdaugh’s phone.
Proceedings
Voir DireMicah Sturgis - Voir DireLine 4
DirectMicah Sturgis - DirectLine 22
CrossMicah Sturgis - CrossLine 21
RedirectMicah Sturgis - RedirectLine 4
RecrossMicah Sturgis - RecrossLine 19
17:54:28

JUDGE NEWMAN: Next witness.

27:54:30

MR. BARBER: Your Honor, the defense calls Micah Sturgis.

37:54:35

The witness, MICAH STURGIS, was first duly sworn and testified as follows:

47:54:41

COURT CLERK: Take a seat in the witness stand. You can adjust the mic at the front when you're seated. State your name again for the record, please, sir. Spell your last name.

57:54:59

MICAH STURGIS: Micah Sturgis, last name S-t-u-r-g-i-s.

67:55:06

VOIR DIRE EXAMINATION

77:55:07

BY MR. BARBER:

87:55:09

MR. BARBER: Good afternoon, Mr. Sturgis.

97:55:11

MICAH STURGIS: Good afternoon.

107:55:13

MR. BARBER: Let's start with can you just tell us about yourself, where you're from?

117:55:17

MICAH STURGIS: Sure. My name a Micah Sturgis. I'm from Charlotte, North Carolina. I am the director of Digital Forensics for Barefoot Professional Investigations.

127:55:24

MR. BARBER: Pull the mic a little closer.

137:55:26

MICAH STURGIS: Sorry. Better? I'm the director of Digital Forensics for Barefoot Investigations.

147:55:32

MR. BARBER: Tell us about your experience in law enforcement and then cell phone forensics.

157:55:37

MICAH STURGIS: So, from 2004 until 2009 -- excuse me, 2016 I was employed by the Cleveland County Sheriff's Office. It's a full service sheriff's office located in Cleveland County, North Carolina. They're on the border of North and South Carolina. During that time period from 2004 to 2006, I was a patrol deputy. In 2006 I was promoted to a corporal, or a training officer, where I trained new hires. In 2009 I was promoted to detective, and in that capacity I handled everything from larcenies to murders. And then I took on the role of the digital forensic examiner for the sheriff's office. I was the first one that we had, and I formed the digital forensics lab at the Cleveland County Sheriff's Office.

167:56:30

MR. BARBER: And before we get more into digital forensics, have you been involved in murder investigations before?

177:56:35

MICAH STURGIS: I have, yes.

187:56:36

MR. BARBER: As a lead detective?

197:56:37

MICAH STURGIS: As a lead detective, yes.

207:56:39

MR. BARBER: And then as you go into digital forensics, tell us about your experience with digital forensics in law enforcement, and then afterwards -- and then after that we'll get to your certifications and training.

217:56:51

MICAH STURGIS: Sure. As the digital forensics examiner for the sheriff's office, it was my responsibility to handle all of the digital evidence that came into the lab and was also -- I was also in charge of ordering things that needed to be ordered and stocked up on for digital forensic purposes. And during that time period, I was sponsored by the United States Secret Service to attend a National Computer Forensics Institute in Hoover, Alabama, where I was trained in multiple device examination, multiple tools: Cellebrite, Blackthorn, which is a form of Berla, XRY was another forensics fool. Paragon was another tool that we used. And so I received that training from the MCFI. They also sent me back with several things, one of which being a laptop computer, or a Mac Book, in order to do examinations on, and also a Ramsey's box, or a Faraday box that I used to use whenever we had phones that came in.

227:57:58

MR. BARBER: And since we're kind of on it, could you go through the training you've had in digital evidence?

237:58:08

MICAH STURGIS: Sure. So, I've had the basic intermediate cell phone forensics course; introduction, intermediate, advanced computer forensics; internet investigations; introduction to wireless investigations. I was a Lantern Certified Examiner, attended Lantern cell phone training. Lantern is a forensics tool for Apple devices, primarily Apple devices. There's some Androids. Apple IOS forensic. I attended the American Academy of Applied Forensics in Charlotte. Cyber investigations. I was -- like I said, I was nominated and sent to the National Computer Forensics Institute by the United States Secret Service where I received my Mobile Device Examiners Certification. I also received Cellebrite certifications while there at the NCFI. And Paraben's mobile forensic training. Cellebrite Certified Physical Analyst. I received XRY training at the Tennessee Bureau of Investigations and took the XRY intermediate courses.

In 2017 I attended the Infuse Conference in Las Vegas, Nevada, where I sat for my ENC written examination. Later came back to Charlotte and I did the practical examination where I was certified as an EnCase Certified Examiner in 2017. And attended the Magnet User's Submit a couple of times and received some training on their tool there at -- in the -- one in Las Vegas, the other in Nashville. And received introduction to alternate data acquisition training, wireless analysis training. I was -- received my Lantern Certified Examiner from Katana Forensics, my XRY certified examiner from MSAV, the Cellebrite Mobile Forensics Certification Fundamental certification, the Cellebrite Certified Operator certification, Cellebrite Physical Analyst certification, and the Cellebrite Certified Mobile Examiner's certification. And also my EnCase Certified Examiners certification.

248:00:23

MR. BARBER: And can you tell us about how many extractions or acquisitions of digital evidence you've performed?

258:00:31

MICAH STURGIS: Sure. Well over 500 logical physical acquisitions and extractions using Lantern, the Apple device forensic tool, Cellebrite, Blackthorn, XRI, Paraben. And over 750 -- well over 750 images of hard disc drives, or solid state drives of computers and analyzing that data within either FTK, or EnCase Forensics Toolkit. It's a forensic sweep. Examined it in EnCase. Magnet IEF, which is Internet Evidence Finder, that's what they started out as. They're now Magnet. Axiom is the product they produced and put out. So, I've used Axiom to do multiple examinations with that. Imaged with Hardware Forensic Images like the Forensic Falcon. I've used Paraben to get live acquisitions, MacQuisition for Macs and Recon ITR for Mac Books. Also had to collect checkpoint encrypted devices with my time at the bank.

268:01:40

MR. BARBER: And that leads into when did you leave law enforcement, and what have you done since you left?

278:01:47

MICAH STURGIS: Sure. In 2016 I received a phone call from an individual who owned a private firm in Charlotte, and I went to work for him as a digital forensic examiner in the SouthPark area of Charlotte.

288:01:59

MR. BARBER: And after?

298:01:59

MICAH STURGIS: After that, I worked from him -- for him from 2016 until roughly 2019, and then I went to Wells Fargo, where I was one of twenty-four examiners for the Wells Fargo and Company. After leaving Wells Fargo in 2021, I went and formed this lab at Barefoot Professional Investigations.

308:02:25

MR. BARBER: And have you ever been qualified as an expert by a court to testify before?

318:02:32

MICAH STURGIS: Yes, I have, in both criminal and defense work.

328:02:36

MR. BARBER: Okay. Criminal work and civil?

338:02:38

MICAH STURGIS: And civil as well, yes.

348:02:40

MR. BARBER: In the criminal cases, have you been on the defense side and the prosecution side, both sides?

358:02:45

MICAH STURGIS: I've been on both.

368:02:46

MR. BARBER: Have you ever been qualified as an expert in digital forensics in a murder case before?

378:02:52

MICAH STURGIS: I have, yes, in 2015.

388:02:54

MR. BARBER: And was that for the prosecution?

398:02:57

MICAH STURGIS: It was for the prosecution.

408:02:59

MR. BARBER: Your Honor, at this time I would offer the witness as an expert in cell phone forensics.

418:03:05

MR. CONRAD: No objection from the State.

428:03:07

JUDGE NEWMAN: He's so qualified.

438:03:08

DIRECT EXAMINATION

448:03:09

BY MR. BARBER:

458:03:10

MR. BARBER: Mr. Sturgis, before we get into the -- what we're here to talk about, are you paid by the defense to be here?

468:03:16
478:03:16

MR. BARBER: How much?

488:03:16

MICAH STURGIS: My rate is $300 an hour for any type of examination work or consultation, and then $600 an hour to be on the stand.

498:03:28

MR. BARBER: And does that go to the company that employees you?

508:03:31
518:03:32

MR. BARBER: And in your experience, are you aware of anyone who does this work for free for the defense?

528:03:37

MICAH STURGIS: No, I'm not. In fact, I do IDS work and --

538:03:40

MR. BARBER: What is that?

548:03:41

MICAH STURGIS: IDS work is Indigina (sic) Service, so people who can't afford defense experts, and I do that work and the state pays me.

558:03:55

MR. BARBER: Turning to this case, have you -- what information have you reviewed regarding cell phones in this case?

568:04:02

MICAH STURGIS: Everything that I've been able to look and review has been provided by the State.

578:04:07

MR. BARBER: And specifically the extractions with -- where the --

588:04:10

MICAH STURGIS: Right. Specifically extractions of the mobile devices and reports that they produced.

598:04:16

MR. BARBER: So, you haven't done anything independent of what the State has provided.

608:04:20

MICAH STURGIS: No, only the State's data.

618:04:21

MR. BARBER: Okay, and have you had a chance to review the timeline that's been introduced into evidence in this case? I believe it was -- I don't have the exhibit number on, on me, but the large timeline of events that --

628:04:37

MICAH STURGIS: The one provided by the State?

638:04:38
648:04:38
658:04:39

MR. BARBER: And as far as the cell phone information goes, is that timeline accurate?

668:04:43

MICAH STURGIS: It is. There -- with the exception of a couple of things based off interpretation of the data, but for the most part, yes, it is accurate.

678:04:55

MR. BARBER: Is anything missing?

688:04:56

MICAH STURGIS: There are two instances where there's some things from the Knowledge data -- KnowledgeC database that aren't in the report that I've been able to locate and identify.

698:05:07

MR. BARBER: Okay. We'll later on get to that, but we don't have to belabor it because it will just be filling in those gaps. The three phones here, you know, Paul, Alex, and Maggie Murdaugh, did you -- what did you do with Paul's phone, if anything?

708:05:25

MICAH STURGIS: With Paul's phone, the extraction reports that I received, there wasn't much data after 8:49, somewhere in that time, on 6/7. So, I didn't really focus much on that one. With Alex's phone, that one I reviewed the steps that were there in the Apple Health sections, and with Maggie I really focused my attention on Maggie's.

718:05:51

MR. BARBER: And all -- so, we'll focus on her phone. Was there any GPS data on her phone?

728:05:58

MICAH STURGIS: There was GPS data, but there was nothing from 6/7.

738:06:01

MR. BARBER: And do you remember when the GPS data started?

748:06:05

MICAH STURGIS: It was 6/9.

758:06:07

MR. BARBER: And you mentioned when talking about I think your qualifications with Faraday bags or boxes, what are those?

768:06:16

MICAH STURGIS: So, if Faraday bag, or a Faraday shield, is something that completely takes the device off the network. It also prevents a GPS signal from breaching the device and changing data to the device.

778:06:30

MR. BARBER: If you could, describe your experience working with those in law enforcement.

788:06:34

MICAH STURGIS: Sure. Part of my responsibility as the -- when I worked at the sheriff's office as head of the digital forensics lab was to make purchases. So, I would purchase these Faraday bags for our patrol officers so when they came out on a scene and came across -- if we had an instance of a crime where a phone was used and any of us seized that phone, they had access to those bags, either in their cars or back at the office in the shared vault room where they could go in and put their evidence up. And if it's a good bag, which, you know, if you buy the right bag and the phone is put in there the proper way, then it, it prevents signal from reaching the phone.

798:07:16

MR. BARBER: And then did you mention a box?

808:07:18

MICAH STURGIS: Yeah. It's -- so, it's a Ramsey's box is what I called it. The Secret Service provided that to me when I left their training, and with that box what I would -- I would take the box from the Faraday -- from evidence that was in the Faraday bag wrapped up, put it inside the Faraday box, or the Ramsey's box. It has two gloves that I would shove my hands into. My computer and the forensic software would be plugged into the side of the Ramsey's box. It was a powered box. There's a light on the inside, so it had a window I could look into, and then I could manipulate the bag and open it up and pull the phone out and keep everything in that Faraday shield.

818:07:58

MR. BARBER: In your opinion, if Maggie Murdaugh's phone had been secured in the way you just described, would it have GPS data from 6/7?

828:08:05

MICAH STURGIS: It likely would have.

838:08:06

MR. BARBER: Let me show what's been admitted as State's Exhibit 278.

848:08:08

MR. BARBER: Can we show what's been admitted as State's Exhibit 278, please? Can we see the top of the --

858:08:37

(Break in proceedings.)

868:08:38

MR. BARBER: Now, sir, do you know what the little arrow in the top left of the phone screen is?

878:08:44

MICAH STURGIS: That's the locations --

888:08:45

JUDGE NEWMAN: You have to speak louder, please.

898:08:47

MICAH STURGIS: I'm sorry.

908:08:48

MICAH STURGIS: That's a location services arrow.

918:08:50

MR. BARBER: Okay. I probably should have asked first. This was admitted as a photo of Maggie Murdaugh's phone in the lab before the extraction. Have you seen this before and do you recognize it?

928:08:59

MICAH STURGIS: Yes, I have.

938:09:00

MR. BARBER: And, again, that arrow indicates --

948:09:01

MICAH STURGIS: Yes. The location services are active on the device even though the phone is in airplane mode.

958:09:07

MR. BARBER: Does that mean right there in the lab it's writing GPS data?

968:09:14
978:09:15

MR. BARBER: You can take that down.

988:09:19

MR. BARBER: I show you what's been marked as Defendant's Exhibit 156 and ask you if you recognize that.

998:09:33

MICAH STURGIS: I do. This is Alex Murdaugh's steps and Maggie Murdaugh's steps from the Apple Health data.

1008:09:42

MR. CONRAD: No objection.

1018:09:45

MR. BARBER: Your Honor, I would offer, I believe without objection, Defendant's Exhibit 156 into evidence.

1028:09:53

MR. CONRAD: No objection.

1038:09:55

JUDGE NEWMAN: It's admitted.

1048:09:57

(REPORT MARKED AS DEFENDANT'S EXHIBIT NUMBER 156 WAS RECEIVED INTO EVIDENCE.)

1058:10:02

MR. BARBER: Will you pull up -- it's the Apple --

1068:10:06

MR. BARBER: I'm going to just ask you to explain what some of these terms are. How does -- and obviously from the title this is Alex Murdaugh's phone. How does the phone come up with that steps number?

1078:10:20

MICAH STURGIS: There are accelerometers --

1088:10:21

MR. BARBER: Pull the mic a little closer, please.

1098:10:23

MICAH STURGIS: I'm sorry. It will help if I sit up a little further. There's accelerometers inside the device. So, whenever the phone is jostled or moved and the accelerometer is moved, then that accelerometer data logs a step, so -- and depending upon where the device is on you, if it's on your waist or in your pocket or you're holding it in your hand when you're walking, that movement of the accelerometer indicates those steps.

1108:10:54

MR. BARBER: And what can -- how does it come up with the distance that goes -- that corresponds with those steps?

1118:11:01

MICAH STURGIS: It uses the satellite's GPS.

1128:11:03

MR. BARBER: Okay, and what does the start and stop times, what do they mean?

1138:11:08

MICAH STURGIS: So, in the Apple Steps or Apple Health data here, you see, for instance, entry 26 that the -- between the times of 7:55:32 and 8:05:07 that 5 -- excuse me, 270 steps were taken during that time period.

1148:11:29

MR. BARBER: Okay. Now, does that -- do we know when in that time period the steps occurred?

1158:11:36

MICAH STURGIS: We know that the steps, or the logging of those steps started at 7:55 and 32 seconds, but whether -- we don't know each individual step, when each individual step took place. We just know that some time during that timeframe those 270 steps were taken.

1168:11:55

MR. BARBER: Between the steps numbers and the distance, do you have an opinion on which one is maybe more accurate?

1178:12:00

MICAH STURGIS: In my opinion, the steps are going to be more accurate.

1188:12:04

MR. BARBER: Why is that?

1198:12:05

MICAH STURGIS: Because the accelerometer in the hardware in the phone, they're more accurate.

1208:12:09

MR. BARBER: Does that mean that the distance is not useful information?

1218:12:12

MICAH STURGIS: It doesn't mean that the distance isn't useful information. I think the totality of everything altogether is what we have to look at here.

1228:12:23

MR. BARBER: The second page.

1238:12:26

MR. BARBER: And is this the same thing for Maggie Murdaugh's phone?

1248:12:32
1258:12:33

MR. BARBER: Before we get into time, just some other things to cover. There's been a lot of talk so far about orientation changes --

1268:12:39

MR. BARBER: Can take that down.

1278:12:40

MR. BARBER: What is an orientation change on an IPhone?

1288:12:45

MICAH STURGIS: So, an IPhone has two orientations. It has a portrait, or up and down, or landscape, which is horizontal or sideways. And whenever a -- whenever the device is backlit, that's when the orientation change will log and show. Now, we're not specifically talking about like a phone, if you physically take the phone and you turn it like this, we're not talking about the physical --

1298:13:13

MR. BARBER: And I'm just going to interrupt a second. I know they don't let you have a phone, but since you're gesturing --

1308:13:17

MICAH STURGIS: All right, thank you.

1318:13:18

MR. BARBER: -- there's a phone that might help.

1328:13:19

MICAH STURGIS: So, what we're talking about is not the physical positioning of the phone but the orientation of the data that you're reading on that device, the orientation change.

1338:13:32

MR. BARBER: And what do the start and end times mean for orientation change?

1348:13:36

MICAH STURGIS: So, when a orientation change is made, a start time is logged, that's the start time of the orientation change that you're seeing on the device itself.

1358:13:48

MR. BARBER: For Maggie's phone, what was the last orientation change? When was that?

1368:13:51

MICAH STURGIS: I believe that was 9:06 and 12 seconds p.m. on 6/7.

1378:13:55

MR. BARBER: And when did that one end or complete?

1388:13:58

MICAH STURGIS: I believe that was 9:06 and 20 seconds.

1398:14:02

MR. BARBER: And at -- when it completed, what was the orientation of the phone for the rest of the night?

1408:14:09

MICAH STURGIS: It was in portrait mode.

1418:14:11

MR. BARBER: If the screen is off, can an orientation change occur?

1428:14:14

MICAH STURGIS: If the screen is off, no, the orientation change can't occur.

1438:14:21

MR. BARBER: If the orientation change happens in the database at the exact moment the screen comes on, does that tell you anything?

1448:14:28

MICAH STURGIS: When I see that, when I see a orientation change at the exact time the screen is lit up, if the device was in horizontal or landscape mode and then moved into portrait mode and the screen comes on, and then all of the sudden the exact same time it changes into portrait mode, to me that indicates that the phone was in a portrait mode position, and then the screen comes on and the orientation change takes place inside.

1458:15:01

MR. BARBER: So, does that mean that movement when the screen is off can appear as an orientation change when the screen comes on?

1468:15:11

MICAH STURGIS: When the screen comes on, yes. When the screen is backlit, that's when the orientation change -- it cannot make an orientation change unless the back screen is lit.

1478:15:18

MR. BARBER: So, kind of moving on then to -- we've talked about orientation changes and they don't happen when the screen is off, you said. Can motion of the phone turn on the screen?

1488:15:31

MICAH STURGIS: Yes. Very little motion can turn on the screen.

1498:15:34

MR. BARBER: And what is the Raise to Wake feature of an IPhone?

1508:15:36

MICAH STURGIS: So, the -- Apple has a Raise to Wake feature that's set by default. Currently this phone -- unfortunately you can't see there, but --

1518:15:45

MR. BARBER: Well, could you -- with the Court's permission, can you come down to show the jury?

1528:15:54

MICAH STURGIS: Currently the phone is off. Now it's on. See that small movement? Can I put it right here? Okay. A slight raising of the phone will indicate slightly. So, when the phone is here, if you raise the phone, it raises to wake. So, if you raise the phone like that, if the phone is flipped over, you can flip the phone back over, it wakes up. If you move the phone from -- it's this mode -- to here, the phone comes on. So, that's the Raise to Wake function.

1538:16:44

MR. BARBER: And was this feature turned on on Maggie Murdaugh's phone on June 7th?

1548:16:48

MICAH STURGIS: By all indications on the database there were -- that it was there, yes.

1558:16:55

MR. BARBER: Okay. Are you familiar with the location of Maggie Murdaugh's phone when it was covered -- by law enforcement on 6/8?

1568:17:03
1578:17:04

MR. BARBER: And have you reviewed the recently received GPS data for Alex Murdaugh's Suburban when it was passing that location?

1588:17:14
1598:17:16

MR. BARBER: Okay. So, do you know when the Suburban passed the location of the phone?

1608:17:22

MICAH STURGIS: When it was leaving the house where the crimes took place, it was around 9:08 when it was passing the location where that phone was located. And then on the return trip back, it was 9:59 and, I believe, 19 seconds.

1618:17:40

MR. BARBER: Was Maggie Murdaugh's phone screen off during those times?

1628:17:49
1638:17:52

MR. BARBER: Now, you're just here as a cell phone expert, right?

1648:17:54

MICAH STURGIS: That's correct.

1658:17:55

MR. BARBER: So, can you offer any expert opinion on how a phone would tumble or bounce or move when thrown from a car going 40 plus miles an hour into the brush on the side of a country road?

1668:18:09

MICAH STURGIS: No. There's too many variables and I'm not an expert on physics.

1678:18:13

MR. BARBER: Can you tell us how much motion would be required for the screen to come on on a phone?

1688:18:18

MICAH STURGIS: Very little. Just, you know, just reaching and picking this phone up like I just did there, the phone comes on, so it can be very little.

1698:18:27

MR. BARBER: Okay, and, again, in the times that Alex Murdaugh's car was passing, the screen never came on.

1708:18:39

MICAH STURGIS: That's correct. The database indicated it was off.

1718:18:46

MR. BARBER: If we can turn to Maggie Murdaugh's phone, I show you what's been marked as Defendant's 158. Do you recognize this?

1728:19:04
1738:19:07

MR. BARBER: What is it?

1748:19:10

MICAH STURGIS: This is a PowerPoint presentation printed off that you put together, but it's based off of the KnowledgeC database data.

1758:19:21

MR. BARBER: And to be clear, I typed it into PowerPoint. Have you reviewed every slide in that presentation?

1768:19:26
1778:19:26

MR. BARBER: Have you verified the data on every slide?

1788:19:28
1798:19:29

MR. BARBER: And you have confirmed independently the data on every slide?

1808:19:34
1818:19:35

MR. CONRAD: No objection.

1828:19:38

MR. BARBER: Your Honor, I would offer what's been marked as Defendant's 158 into evidence.

1838:19:46

JUDGE NEWMAN: It's admitted without objection.

1848:19:50

(REPORT MARKED AS DEFENDANT'S EXHIBIT NUMBER 158 WAS RECEIVED INTO EVIDENCE.)

1858:19:56

MR. BARBER: So, let me go through this.

1868:20:00

MR. BARBER: No, don't zoom the screen.

1878:20:04

MR. BARBER: So, we're looking at just a very short period of time, right? If you would, describe the time period you're looking at.

1888:20:10

MICAH STURGIS: Yes. This is on June 7th from 8:49 p.m. until 9:07 p.m.

1898:20:18

MR. BARBER: All right. So, we're going to go through here and just see exactly what was happening with her phone on that time.

1908:20:24

MR. BARBER: So, the next slide, please.

1918:20:26

MR. BARBER: What's happening here?

1928:20:26

MICAH STURGIS: At 8:49 and 26 seconds --

1938:20:28

MR. BARBER: If you could pull the mic closer.

1948:20:30

MICAH STURGIS: Sorry. At 8:49 and 26 seconds, that's the last text message that was read by Maggie. It was indicated read on the device.

1958:20:39
1968:20:39

MICAH STURGIS: At 8:49 and 28 seconds, the backlight goes off.

1978:20:43

MR. BARBER: And what does that mean?

1988:20:46

MICAH STURGIS: That means that --

1998:20:47

MR. BARBER: The screen is --

2008:20:49

MICAH STURGIS: -- the screen is dark, sorry.

2018:20:51
2028:20:52

MICAH STURGIS: At 8:49 and 31 seconds, the phone locks, and it remains locked until it's recovered by law enforcement the next day.

2038:20:59
2048:20:59

MICAH STURGIS: At 8:53 and eight seconds, the backlight comes back on. The phone is illuminated.

2058:21:06

MR. BARBER: And next?

2068:21:08

MICAH STURGIS: At 8:53 and 12 seconds, orientation to portrait starts.

2078:21:16
2088:21:18

MICAH STURGIS: At 8:53 and 15 seconds, that's when the phone began logging the 59 steps.

2098:21:25
2108:21:26
2118:21:26

MR. BARBER: And it's on the screen by you, sorry.

2128:21:30

MICAH STURGIS: And at 8:53 and 20 seconds there's Siri usage. This was indicated in the KnowledgeC Database, and that can be done by squeezing the side button on the phone and holding onto it for a short amount of time and Siri activates at that point.

2138:21:45

MR. BARBER: So, this is a user interface --

2148:21:48

MICAH STURGIS: Yeah. This is -- it actually shows up at Siri in the device, so it's Siri user interface.

2158:21:55
2168:21:56

MICAH STURGIS: At 8:53 and 24 seconds, the orientation to portrait completes.

2178:22:02
2188:22:03

MICAH STURGIS: At 8:53 and 28 seconds, the backlight goes off again, so the phone is dark.

2198:22:09
2208:22:09

MICAH STURGIS: At 8:53 and 32 seconds, the backlight comes back on and the phone illuminates.

2218:22:18
2228:22:19

MICAH STURGIS: At 8:53 and 44 seconds, the backlight goes off again.

2238:22:22

MR. BARBER: Do you have any opinion about why it just popped on and off like that?

2248:22:26

MICAH STURGIS: I mean, there were no indications in the KnowledgeC database that any notifications came in or anything of that nature. The only thing I could think would be that the phone would jostle or, or, or lifted or somehow the light came on.

2258:22:41
2268:22:42

MICAH STURGIS: At 8:54 and 32 seconds, the backlight comes on.

2278:22:48
2288:22:50

MICAH STURGIS: At 8:54 and 34 seconds there's an entry in the KnowledgeC database about the camera usage and the camera starts. So, in that there are -- in that database -- and if you don't mind, I'll kind of expand on this. In that database, the KnowledgeC database is comprised of tables and rows and columns. And in that database, on that specific item where the camera was, there is another column that is called the Z structure metadata. And so if I followed the camera under the value stream there indicating that the camera was activated, if I follow that line all the way across to where that structured database -- excuse me, structured metadata is in that table, I'll get a PK number, or a primary key number. That number was 571. In the KnowledgeC database, there's another table within the KnowledgeC database called Z structured metadata. So, if I to go that table, because I found that number under the Z structured metadata column, if I go to that specific table in the database and look for that primary key 571, and I scroll all the way out to the end, I'll see a description of what that 571 is. And in that case it was com.apple.springboard.lockscreen.scroll, which would indicate it was a camera function on the lock screen, and that when you press that button in the bottom right corner of the phone, it has a little camera indication. It'll scroll over to the camera, or you can swipe over to the left, and it indicates that there's a camera there.

2298:24:40

MR. BARBER: So, was this some sort of attempt by the phone on its own at face ID?

2308:24:43

MICAH STURGIS: It didn't indicate that it was a face ID at all. It indicated that it was a camera.

2318:24:48

MR. BARBER: Is by indicating camera, did it indicate that someone -- some person using the phone activated the camera?

2328:24:56
2338:24:57

MR. BARBER: Okay. Next?

2348:24:59

MICAH STURGIS: At 8:54 and 35 seconds, the camera use ends.

2358:25:04

MR. BARBER: Okay, and keeping in mind the timestamp, go to the next slide.

2368:25:10

MICAH STURGIS: And at 8:54 and 40 seconds, orientation to landscape starts.

2378:25:15

MR. BARBER: So, how long was that since the camera usage?

2388:25:20

MICAH STURGIS: About 5 seconds since it ended.

2398:25:24

MR. BARBER: And the next slide?

2408:25:26

MICAH STURGIS: And then at 8:54 and 44 seconds, the orientation to landscape ends.

2418:25:32

MR. BARBER: And next?

2428:25:33

MICAH STURGIS: At 8:55 and 4 seconds, the backlight turns off and the orientation to portrait starts.

2438:25:43

MR. BARBER: And a lot is happening on this one. What's happening here?

2448:25:46

MICAH STURGIS: Yeah. So, right here the phone was previously in landscape mode, and it settled in at that landscape mode at 44 seconds. The backlight went off at 8:55 and 4 seconds. At that same time, the orientation of portrait starts and that's -- this is indicative of what I was talking about earlier when you rotate the phone while it's -- the screen is not lit. And when the screen comes on, the orientation changes. Once the screen pops off, it will flip over to wherever the camera -- or wherever the phone was turned to. And at this time it -- orientation to portrait ends at that time, and the orientation to the landscape stops at that time, so that's exactly what I was talking about. And then the phone stops logging those 59 steps at that time as well.

2458:26:44

MR. BARBER: Let me kind of emphasize this.

2468:26:47

MR. BARBER: Can we go back four slides?

2478:26:50

(Break in proceedings.)

2488:26:51

MR. BARBER: All right. So, when the camera use ends here, 8:54:35, going forward one slide we have an orientation change.

2498:27:02

MICAH STURGIS: That's correct, the landscape starts, yes. Orientation to the landscape ends at 44 seconds after.

2508:27:09

MR. BARBER: And then the next slide.

2518:27:12

MR. BARBER: So, now that the screen has gone off, how long has it been since the camera use?

2528:27:21

MICAH STURGIS: So, it's 8:55 and 04 since the camera use. The camera use ended at 8:54 and 35, and then the backlight goes off at 8:55 and 4 seconds. What is that, a minute?

2538:27:41

MR. BARBER: Is that 29 seconds?

2548:27:43

MICAH STURGIS: Wait, hang on a second. Yes, 29 seconds, I apologize. My math was terrible, wasn't it? Yes.

2558:27:54

MR. BARBER: And then going forward. So, what we had in that 29 seconds was an orientation change, and then the screen goes off.

2568:28:02

MICAH STURGIS: Right, that's correct. Where are we going with it now?

2578:28:16

MR. BARBER: All right. So, let's go back to the slide that's timestamped 8:55:32. Is this where we left off?

2588:28:26

MICAH STURGIS: That's where we left off, yes. So, here the backlight is on, the orientation to portrait ends, and then the orientation to landscape starts immediately when the light -- the backlight comes back up on, and then we -- the phone stops logging those 59 steps at that time as well.

2598:28:45

MR. BARBER: And the next slide 4 seconds later?

2608:28:47

MICAH STURGIS: And 4 seconds later the backlight is back off again.

2618:28:50

MR. BARBER: We'll go kind of quickly here. The next slide comes on --

2628:28:54

MICAH STURGIS: At 9:03 the backlight is on. At 9:04:23 we have a missed call from Alex that starts. At 9:04:23 the backlight goes off.

2638:29:04

MR. BARBER: Now let's go back to the previous slide.

2648:29:07

MICAH STURGIS: One more.

2658:29:07

MR. BARBER: The backlight went off at the exact same time that the call came in from Alex Murdaugh.

2668:29:14

MICAH STURGIS: That's correct, yes.

2678:29:15

MR. BARBER: And now the next slide.

2688:29:17

MICAH STURGIS: And then we have a missed call from Alex that ends at --

2698:29:21

MR. BARBER: That's the call that we just saw, right?

2708:29:23
2718:29:24

MR. BARBER: Do you have an opinion on why the screen light would go off pretty much right when a call comes in?

2728:29:32

MICAH STURGIS: The only thing that I can figure is when the phone come -- or, excuse me, the call came in, that the person hit the side button to turn it off and put it down and flipped the phone over and the backlight comes on.

2738:29:41

MR. BARBER: Do you know of anything on the phone that would cause the screen to go off right when a call comes in and stay off during the call that does not involve human interactions?

2748:29:51

MICAH STURGIS: No, I don't.

2758:29:52

MR. BARBER: Go to the next slide.

2768:29:54

MICAH STURGIS: 9:50 and 44 seconds, the backlight comes back on. Then in 9:06 and 12 seconds, the orientation changed to portrait again.

2778:30:03

MR. BARBER: Okay, and then the next one? And we'll stop on that.

2788:30:09

MICAH STURGIS: At 9:06 and 14 seconds, there's an incoming call from Alex that starts at that time.

2798:30:14

MR. BARBER: And then the next one?

2808:30:15

MICAH STURGIS: And then the incoming call from Alex ends at 9:06 and 18 seconds.

2818:30:20

MR. BARBER: And the next slide?

2828:30:21

MICAH STURGIS: And then we have an orientation change to portrait ends at 9:06 and 20.

2838:30:24

MR. BARBER: And stopping here. That call we just saw coming in from Alex, that was sandwiched within this orientation change.

2848:30:33

MICAH STURGIS: That's correct, yes, it was in between them.

2858:30:36

MR. BARBER: And the next slide?

2868:30:38

MICAH STURGIS: 9:06:52, we have another incoming call from Alex that starts.

2878:30:42

MR. BARBER: And the next one?

2888:30:44

MICAH STURGIS: And then it ends. The incoming call from Alex ends at 9:06 and 59 seconds.

2898:30:50

MR. BARBER: And now to the last slide.

2908:30:53

MICAH STURGIS: At 9:07 the backlight goes off and it remains off until 9:31 and 44 seconds.

2918:31:00

MR. BARBER: Do you know from your review of the GM GPS data where the -- Alex Murdaugh's Suburban was at 9:07?

2928:31:13

MICAH STURGIS: Yes. At 9:07 -- right. He was, it looks like, traveling from the house -- or from his home to the house in -- I forget the name of the city.

2938:31:30

MR. BARBER: Right at -- precisely at 9:07 where was he at that moment?

2948:31:34

MICAH STURGIS: 9:07 would be the driveway, I believe.

2958:31:38

MR. BARBER: The driveway.

2968:31:39
2978:31:40

MR. BARBER: And Maggie's phone, the screen did not come on again until 9:31?

2988:31:46

MICAH STURGIS: That's correct.

2998:31:47

MR. BARBER: And just one more time, how much motion does it take to turn the screen?

3008:31:51

MICAH STURGIS: Very little. Just the slightest lift of the phone turns the screen on.

3018:32:10

MR. BARBER: Beg the Court's indulgence.

3028:32:27

(Break in proceedings.)

3038:32:35

MR. BARBER: Please answer any questions from the State. I have no further questions.

3048:32:45

(Break in proceedings.)

3058:32:46

JUDGE NEWMAN: Mr. Conrad?

3068:32:48

MR. CONRAD: Thank you, your Honor. May it please the Court?

3078:32:52

CROSS-EXAMINATION

3088:32:53

BY MR. CONRAD:

3098:32:54

MR. CONRAD: Mr. Sturgis, how are you doing today?

3108:32:57

MICAH STURGIS: Good afternoon, Mr. Conrad. I'm well. Thank you.

3118:33:03

MR. CONRAD: I believe at the beginning of your testimony you testified that you felt likely there was some location data stored on Maggie's phone from June 7th that potentially was overwritten. Did I understand that correctly?

3128:33:19

MICAH STURGIS: I said there was data that was on the phone from June 8th, and that -- correction, June 9th, and that data likely could have been on there had it been preserved properly.

3138:33:35

MR. CONRAD: And explain to the jury just real quick. How does an IPhone store that GPS information in generic terms? Then if I need to get more specific, I will.

3148:33:45

MICAH STURGIS: Sure. So, the IPhone -- the IPhone keeps that data and it uses the GPS location. The GPS satellite triangulates with the GPS satellites and stores that data.

3158:33:58

MR. CONRAD: And does it store it a in sort of cache?

3168:34:02

MICAH STURGIS: It does, there's a cache.

3178:34:05

MR. CONRAD: When it comes to IOS as opposed to, say, a standard hard drive, IOS keeps certain databases' caches fairly limited, correct?

3188:34:11

MICAH STURGIS: That's correct.

3198:34:11

MR. CONRAD: It doesn't allow them to access the entire memory available on the device at any given point. Is that correct?

3208:34:17

MICAH STURGIS: That's correct, yes.

3218:34:18

MR. CONRAD: Okay, and do you know, or at least in your training or your investigation, have you been able to determine just how big a typical cache is, at least would have been for Maggie's phone during this time?

3228:34:31

MICAH STURGIS: No, I didn't research that.

3238:34:32

JUDGE NEWMAN: Speak up, sir.

3248:34:33

MICAH STURGIS: No, I didn't research that, no.

3258:34:35

MR. CONRAD: Okay. So, you don't know how long Maggie's phone would have potentially stored GPS information at this -- during 2021, correct?

3268:34:43

MICAH STURGIS: That's correct.

3278:34:45

MR. CONRAD: Okay, and just so I understand correctly, you agree that a IPhone will not record an orientation change if the screen is off, correct?

3288:35:00

MICAH STURGIS: That is correct, yes.

3298:35:03

MR. CONRAD: All right. So, I believe Mr. Barber handed you his phone to kind of demonstrate this lift to wake thing, correct?

3308:35:13

MICAH STURGIS: That's correct, yes.

3318:35:15

MR. CONRAD: And do you know what model IPhone Mr. Barber has? Did you look at it?

3328:35:19

MICAH STURGIS: I don't know exactly which IPhone he has.

3338:35:21

MR. CONRAD: Okay, and do you know what model -- version of IOS is on Mr. Barber's phone?

3348:35:24

MICAH STURGIS: I do not know.

3358:35:25

MR. CONRAD: And Apple updates its IOS fairly frequently, correct?

3368:35:27

MICAH STURGIS: They do, yes.

3378:35:28

MR. CONRAD: Do you know at least -- we don't know what's on Mr. Barber's phone, but do you know what the current release version is today offhand?

3388:35:37

MICAH STURGIS: It's 16 point something, yeah.

3398:35:39

MR. CONRAD: Do you know in your review of Maggie's phone what version was on Maggie's phone on June 7th of 2021?

3408:35:45

MICAH STURGIS: I believe that was 14 point something.

3418:35:47

MR. CONRAD: I'm sorry?

3428:35:48

MICAH STURGIS: I think it was 14.6, if I'm not mistaken. It was somewhere in the 14 range.

3438:35:53

MR. CONRAD: And are you aware that in some of these update -- IOS updates, some of these sensitivities and some of these settings can change, correct?

3448:36:02

MICAH STURGIS: Depending on bug fixes and things, yes.

3458:36:07

MR. CONRAD: And are you aware of a change that occurred in IOS 15 that changed it to how IPhones record orientation changes, or when they record orientation changes?

3468:36:18

MICAH STURGIS: No. I'm not aware of that.

3478:36:27

MR. CONRAD: Okay. Okay.

3488:36:32

MR. CONRAD: Can we go back to the -- I forget, let's see, to the PowerPoint. What exhibit was that? I believe it was -- was it 158?

3498:36:57

(Break in proceedings.)

3508:37:03

MR. CONRAD: For this witness.

3518:37:12

(Break in proceedings.)

3528:37:17

MR. CONRAD: This doesn't have slide numbers, so bear with me, but -- first of all, before we talk about Maggie real quick, you did review Paul's phone to a certain degree, correct?

3538:37:35

MICAH STURGIS: To a certain extent, yes.

3548:37:36

MR. CONRAD: All right, and do you recall from your review of Paul's phone when the last time his phone was unlocked on June 7th of 2021?

3558:37:42

MICAH STURGIS: I don't recall, no, I'm sorry.

3568:37:47

MR. CONRAD: And we can find the State's Exhibit if we need to, but would you disagree if I told you it was 8:49 p.m. or shortly thereafter, 8:49 p.m.?

3578:37:54

MICAH STURGIS: If that's -- if that's -- if that's what's in the State's exhibit, I don't disagree with that.

3588:37:57

MR. CONRAD: Okay, and I believe one of your first slides here is that Maggie's phone locked?

3598:38:09

MR. CONRAD: Let's see, got one, two, three slides. one more. Back one, I'm sorry.

3608:38:16

MR. CONRAD: 8:49:31, and your review of Maggie's phone found that her phone was locked at 8:49:31, correct?

3618:38:25

MICAH STURGIS: That's correct, yes.

3628:38:26

MR. CONRAD: And was not unlocked until when, the next day?

3638:38:30

MICAH STURGIS: The next day, that's correct.

3648:38:32

MR. CONRAD: All right, and that's when it was recovered by law enforcement?

3658:38:36

MICAH STURGIS: By law enforcement, yes, sir.

3668:38:38

MR. CONRAD: Okay, and did you review Alex's? You said you reviewed Alex's phone to a certain degree, too. I think you said the steps, right?

3678:38:42

MICAH STURGIS: The steps, yes.

3688:38:43

MR. CONRAD: And in your review, did you find any steps on his phone between 8:09 and 9:02 p.m.?

3698:38:50

MICAH STURGIS: I'll go back and take a look at that. 8:09 and 9:02 p.m., correct?

3708:38:59

MR. CONRAD: Correct.

3718:39:00

MICAH STURGIS: I don't recall seeing that, seeing the stuff on the KnowledgeC here.

3728:39:06

MR. CONRAD: Okay. All right, but Maggie's phone is locked at 8:49:31 and then does not unlock until the next day, correct?

3738:39:18

MICAH STURGIS: That's correct, yes, sir.

3748:39:20

MR. CONRAD: Paul's locks for the last time around the same time, correct?

3758:39:22

MICAH STURGIS: That is correct, yes, sir.

3768:39:23

MR. CONRAD: And Paul's phone, in your review, do you recall what time the battery died on his phone?

3778:39:27

MICAH STURGIS: I don't recall, no, sir.

3788:39:29

MR. CONRAD: Would you dispute if I said -- and we can find the exhibit if we need to -- his phone shut down at about 10:34 p.m.?

3798:39:36

MICAH STURGIS: If that's what's in the report, I don't dispute it, no, sir.

3808:39:40

MR. CONRAD: All right, and would you agree with me if I said that Paul's phone locking at 8:49 and remaining on until 10:34 -- first of all, that's about, what, a hour and a half or so?

3818:39:52

MICAH STURGIS: That's correct, yes.

3828:39:53

MR. CONRAD: And do you know his battery state when his phone locked at 8:49 p.m.?

3838:39:58

MICAH STURGIS: It was in low power mode.

3848:40:00

MR. CONRAD: All right, and so it was less than 10 percent, 2 percent, something like that?

3858:40:03

MICAH STURGIS: Yes, that's correct.

3868:40:03

MR. CONRAD: All right, and would you agree with me that when -- the fact that his phone remained on until 10:34 would be indicative that it wasn't really handled much at all or used at all?

3878:40:14
3888:40:15

MR. CONRAD: Okay, and did you find any other evidence of any usage on Paul's phone after 8:49 that you can recall?

3898:40:22

MICAH STURGIS: No, I didn't.

3908:40:24

MR. CONRAD: And when I say use, just so it's clear between us, I mean either answering a call, making a call, reading a text, sending a text --

3918:40:35
3928:40:35

MR. CONRAD: -- orientation change.

3938:40:37

MICAH STURGIS: No user interaction.

3948:40:38

MR. CONRAD: Okay. All right, and so let's talk a little bit about the orientation change for a minute.

3958:40:45
3968:40:47

MR. CONRAD: So, would you agree that most -- the most likely reason for an orientation change is human interaction, meaning humans using the phone?

3978:40:55
3988:40:56

MR. CONRAD: All right. Are there any other possible explanations? When you see an orientation change, are there any other explanations that you -- in your opinion that could explain an orientation change?

3998:41:06

MICAH STURGIS: Only if a phone, you know, was in one position, lit up, fell off, and landed in another position.

4008:41:13
4018:41:13
4028:41:14

MR. CONRAD: And when you see a series of orientation changes, you know, 30 seconds or a minute between each orientation change, it would be difficult to explain that by a phone just kept falling on its own, correct?

4038:41:25

MICAH STURGIS: Repeat the question again. I'm sorry.

4048:41:26

MR. CONRAD: If you see a series of three orientation changes, just speaking hypothetically for a moment, if you see a series of three orientation changes, you know, say 30 seconds separate them or thereabouts or a minute separate them, would that be able -- would that -- could you explain that -- would it be very likely that a series of falls caused those orientation changes?

4058:41:48

MICAH STURGIS: It depends on how many falls it was making. But, you know, being jostled around in a pocket with the light on, being turned, if it's in a person's hand being turned back and forth, and that would be the only thing that could indicate with an orientation change.

4068:42:04

MR. CONRAD: Okay. All right.

4078:42:06

MR. CONRAD: Can we pull that slide show back up, please? Let's go forward one, two. Okay. 8:53:15. There you go.

4088:42:26

MR. CONRAD: And this is when Maggie's phone starts showing some steps, correct?

4098:42:29

MICAH STURGIS: That's correct, yes.

4108:42:31

MR. CONRAD: And you would agree that the most likely explanation for this is the phone is moving in some manner, correct?

4118:42:38

MICAH STURGIS: That's correct, yes.

4128:42:39

MR. CONRAD: And shows accelerometers are reporting -- or the bounces and jostling, that would be -- most likely be explained by steps, correct?

4138:42:44

MICAH STURGIS: That's correct, yes.

4148:42:45

MR. CONRAD: You can't tell us who is carrying that phone at this time, can you?

4158:42:51
4168:42:52

MR. CONRAD: All right, next slide.

4178:42:55

MR. CONRAD: All right, and so at this 8:53:20, you say there's some Siri usage and the squeezing of the side button, and let's just -- is that the only explanation of why you would see Siri pop up on a phone is squeezing a side button, or are there other possibilities?

4188:43:12

MICAH STURGIS: There's another possibility of her saying, you know, hey, Siri. That happens because it's a Siri user interface.

4198:43:20

MR. CONRAD: Okay. So, there could be another explanation, but it's most likely someone squeezing a side button saying, hey, Siri?

4208:43:23

MICAH STURGIS: Could be the someone saying, hey, Siri. But it's a user interface to it.

4218:43:30

MR. CONRAD: Okay. All right.

4228:43:32

MR. CONRAD: Go to 8 -- next slide, please. Actually, let's go to 8:54:34, please. There should be one more. One more. There we go.

4238:43:58

MR. CONRAD: All right, and here you say that the camera gets activated, correct?

4248:44:03

MICAH STURGIS: That's correct.

4258:44:04

MR. CONRAD: And you, you think the most likely explanation is somebody swiped the camera symbol on a locked phone, correct?

4268:44:11

MICAH STURGIS: Right. Either swiped camera or touched the bottom button because it's coming from the springboard lock screen.

4278:44:15

MR. CONRAD: Okay. When you say bottom button, which button is that?

4288:44:17

MICAH STURGIS: If you're looking at an IPhone -- and my most recent I-List, I think it's 16 point something. In the bottom right corner, there's a button that you can touch and hold and the camera comes on. When that happens, it comes over from the left and the camera just scrolls over.

4298:44:35
4308:44:36

MR. CONRAD: And then the next slide?

4318:44:38

MR. CONRAD: And at 8:54:35 -- this is 1 second later -- the camera use ends, correct?

4328:44:43

MICAH STURGIS: That's correct, yeah.

4338:44:44

MR. CONRAD: And so in your opinion, based off the fact that that was used for a total of 1 second, do you think that was someone intending to actually use the camera and take a picture?

4348:44:54

MICAH STURGIS: I wouldn't know, but I wouldn't think so. That's just a --

4358:44:57

MR. CONRAD: The camera was only open for a second, correct?

4368:44:59

MICAH STURGIS: Right. They couldn't have taken a picture in a second.

4378:45:10

MR. CONRAD: All right.

4388:45:14

MR. CONRAD: 8:55:32.

4398:45:19

MR. CONRAD: Okay, and we see the orientation change here at 8:55:32.

4408:45:26

MR. CONRAD: Next slide.

4418:45:28

MR. CONRAD: And the backlight goes off at 8:55:36, correct?

4428:45:30

MICAH STURGIS: That's correct, yes, sir.

4438:45:30

MR. CONRAD: And we go to the next slide, and the backlight is back on the 9:03:52. So, that's roughly how long? Is that 8 minutes? I'm not -- I don't know if I'm going to make you do math, but --

4448:45:45

MICAH STURGIS: Yeah. About that, yes.

4458:45:46

MR. CONRAD: And so the screen is off for that 8 minutes, correct?

4468:45:50

MICAH STURGIS: That's correct.

4478:45:51

MR. CONRAD: And so would you agree with me that it does seem likely someone is handling that phone between -- Maggie's phone between 8:53 and 8:55, correct?

4488:45:58
4498:45:59

MR. CONRAD: All right, and we see orientation changes. We see the potential button being pushed. Someone has got that phone in their hand, correct?

4508:46:05

MICAH STURGIS: That's correct.

4518:46:06

MR. CONRAD: You can't tell us who, correct?

4528:46:08

MICAH STURGIS: No, I can't.

4538:46:09

MR. CONRAD: And then at 8:55:32, we see kind of an 8 minute gap in activity, correct?

4548:46:15
4558:46:15

MR. CONRAD: Between 8:55 and 9:03, correct?

4568:46:18
4578:46:19

MR. CONRAD: Almost as if somebody put that phone down.

4588:46:21

MICAH STURGIS: Yes, that's a possibility.

4598:46:23

MR. CONRAD: Whoever had it, correct?

4608:46:24
4618:46:25

MR. CONRAD: And you can't tell us where they put that phone down, right?

4628:46:28

MICAH STURGIS: No, sir, I can't.

4638:46:29

MR. CONRAD: Could they have put it in a vehicle?

4648:46:31

MICAH STURGIS: That's very possible. I don't know.

4658:46:37

MR. CONRAD: A golf cart?

4668:46:41

MICAH STURGIS: I don't know.

4678:46:45

MR. CONRAD: Okay. Okay. Let's go to 9:04:23. All right, and we see this incoming call from Alex.

4688:46:55
4698:46:56

MR. CONRAD: And you say the screen turns off almost immediately, correct?

4708:46:59

MICAH STURGIS: That's correct, yes.

4718:47:00

MR. CONRAD: In your opinion, you think somebody actually hit the button and turned the screen off.

4728:47:03

MICAH STURGIS: Somebody shut the screen off, yes.

4738:47:04

MR. CONRAD: Okay, but the screen comes back on at 9:05:44.

4748:47:12

MR. CONRAD: If we can go to that slide.

4758:47:14

MR. CONRAD: Correct?

4768:47:14
4778:47:15

MR. CONRAD: And then at 9:06:12, we see an orientation change, correct?

4788:47:19

MICAH STURGIS: That's correct, yes.

4798:47:20

MR. CONRAD: And 2 seconds later we see a what?

4808:47:22

MR. CONRAD: Next slide, please?

4818:47:24

MR. CONRAD: What is this? What is this indicating?

4828:47:26

MICAH STURGIS: That's an incoming call from Alex.

4838:47:27

MR. CONRAD: Okay. 2 seconds after the orientation change starts, correct?

4848:47:35

MICAH STURGIS: That's correct, yes.

4858:47:39

MR. CONRAD: Okay, and then go to 9:07.

4868:47:47

MR. CONRAD: Okay, and the screen goes off at 9:07, correct?

4878:47:51

MICAH STURGIS: That's correct.

4888:47:52

MR. CONRAD: All right, and stays off for what, 23, roughly 23 minutes?

4898:47:57
4908:47:57

MR. CONRAD: And you just testified with Mr. Barber that Alex's car was sitting just outside his house, correct?

4918:48:04

MICAH STURGIS: That's according to the document that I reviewed, yes.

4928:48:07

MR. CONRAD: And a -- I don't know if you have this information in front of you, but did you determine when that GPS data shows his start -- car -- his vehicle start to move?

4938:48:16

MICAH STURGIS: Yes. It --

4948:48:17

MR. CONRAD: After 9:07?

4958:48:18

MICAH STURGIS: Oh, after 9:07?

4968:48:20

MR. CONRAD: Well, first of all, is his vehicle stationary at 9:07?

4978:48:24

MICAH STURGIS: No, it's in the driveway at 9:07, but it starts at the house at 9:06 and 52 seconds p.m.

4988:48:33

MR. CONRAD: When do you start to see motion?

4998:48:35

MICAH STURGIS: 9:06 and 52 seconds is when I start to see the motion there.

5008:48:41

MR. CONRAD: And 8 seconds later is when Maggie's screen turns off?

5018:48:45
5028:48:46

MR. CONRAD: For 23 minutes?

5038:48:47
5048:48:48

MR. CONRAD: And you agree that a phone, IPhone, at least with version 14.6, when the screen is off, it will not record an orientation change, correct?

5058:48:58

MICAH STURGIS: That's correct.

5068:48:59

MR. CONRAD: And you agree with me that you don't know what version IOS that Mr. Barber had on his phone that you just did the demonstration.

5078:49:06

MICAH STURGIS: That's correct.

5088:49:07

MR. CONRAD: Okay. Did you conduct any test with the phone of 14.6 to see what movement can cause it -- or what can cause that screen to come on?

5098:49:15

MICAH STURGIS: I don't have any 14.6 phones.

5108:49:27

MR. CONRAD: Okay. All right.

5118:49:34

MR. CONRAD: Beg the Court's indulgence.

5128:49:44

(Break in proceedings.)

5138:49:48

MR. CONRAD: Nothing further from the State.

5148:50:00

REDIRECT EXAMINATION

5158:50:03

BY MR. BARBER:

5168:50:08

MR. BARBER: Mr. Sturgis, you were asked about IOS Version 15 and a change in orientation behavior. Is the Raise to Wake feature something distinct from orientation behavior?

5178:50:22

MICAH STURGIS: No. The Raise to Wake is a -- separate from orientation behavior. Raised to Wake is a separate application within --

5188:50:30

MR. BARBER: Is Raise the Wake the feature that is supposed to come on with slight movement?

5198:50:35
5208:50:35

MR. BARBER: Do you have any reason to believe that the Raise to Wake feature that you've already testified was active on Maggie Murdaugh's phone works any different than any IPhone today?

5218:50:45

MICAH STURGIS: I have no evidence to prove that, no.

5228:50:52

MR. BARBER: And, again, you can refer to your notes. When Alex Murdaugh's SUV passed the location where Maggie Murdaugh's phone was recovered on the side of road, was the screen off?

5238:51:03

MICAH STURGIS: The screen was off, yes.

5248:51:05

MR. BARBER: It was off as he approached it?

5258:51:09
5268:51:10

MR. BARBER: And, again, how much movement does it take to turn the screen on?

5278:51:16

MICAH STURGIS: Very little movement.

5288:51:18

MR. BARBER: And this is a separate issue from orientation changes.

5298:51:22

MICAH STURGIS: That's correct.

5308:51:23

MR. BARBER: But we're talking about -- are we talking about movement activating the screen?

5318:51:27

MICAH STURGIS: That's correct, yes.

5328:51:29

MR. BARBER: Are we talking about the screen being sideways or up?

5338:51:33

MICAH STURGIS: No, we're not talking about the orientation. We're talking about the actual Raise to Wake function on the phone.

5348:51:40

MR. BARBER: The camera usage -- and, in fact, no picture was taken that you're aware of.

5358:51:45

MICAH STURGIS: Right, that's correct. I didn't see any photographs there at that time.

5368:51:49

MR. BARBER: But your -- is it your opinion -- what is your opinion about whether someone deliberately activated that camera?

5378:51:57

MICAH STURGIS: I mean, they could have. They could -- it could have been accident. I don't know. I don't know what the person could have been doing, but it was a user interaction with the device.

5388:52:08

MR. BARBER: And there was talk about phones falling to change orientation. Can a phone change orientation without actually falling?

5398:52:15

MICAH STURGIS: No. I mean, it's -- it -- there has to be some type of movement for the phone from portrait to landscape.

5408:52:21

MR. BARBER: Right, but you don't have to drop the phone?

5418:52:22
5428:52:22
5438:52:23

MICAH STURGIS: So, if it's sitting upright -- I mean, if it's sitting on its side, I can flip it this way and the orientation changes.

5448:52:32

MR. BARBER: If somebody is running with the phone, can it change orientation?

5458:52:38

MICAH STURGIS: Yes. Those are user events that can cause that.

5468:52:44

MR. BARBER: Pull up what has been previously admitted as Defense Exhibit 45.

5478:52:52

MR. BARBER: This is, as I just said, previously admitted. Do you recognize this as GPS data in a cache database?

5488:53:02

MICAH STURGIS: Yes. This looks like a -- it's a cache for the ZRT cell location database, yes.

5498:53:11

MR. BARBER: And what's the timestamp for the first entry?

5508:53:18

MICAH STURGIS: It's 6/9/21 at 2:51 and 21 seconds p.m.

5518:53:28

MR. BARBER: In your opinion, would it be fair to say that if this phone had been extracted, or put in a Faraday bag a couple of days earlier, we would have GPS data from 6/7?

5528:53:39

MICAH STURGIS: In my opinion, it's likely that we could.

5538:53:46

MR. BARBER: Will you pull up the step data exhibit, Apple step data exhibit?

5548:53:57

(Break in proceedings.)

5558:53:59

MR. BARBER: And we previously talked about this, Alex Murdaugh's steps. Between entries 27 and 28, you see those time periods? I just want you to remember that.

5568:54:16

MR. BARBER: And go to the next page.

5578:54:19

MR. BARBER: Here we have Maggie's steps. Are there any steps -- periods of steps that between -- that correspond between Maggie Murdaugh and Alex Murdaugh?

5588:54:30

MICAH STURGIS: No, I don't see any.

5598:54:33

MR. BARBER: So, there's no -- there's no period where both phones are stepping in the same period.

5608:54:37
5618:54:37

MR. BARBER: Okay, and if we stay on this one, if we look at entries 5 and 6, the distance is almost identical, 31 meters.

5628:54:51

MICAH STURGIS: Yes, it is.

5638:54:53

MR. BARBER: Are the steps different?

5648:54:55

MICAH STURGIS: The steps are different.

5658:54:58

MR. BARBER: Is that a significant difference?

5668:55:01

MICAH STURGIS: Not a significant difference for the 5 and 6, no.

5678:55:04

MR. BARBER: So, 59 versus 43, so is that 16 -- it took 16 more steps to go the same distance?

5688:55:21
5698:55:23

MR. BARBER: So, does that indicate shorter steps?

5708:55:29

MICAH STURGIS: Shorter steps, yes.

5718:55:33

MR. BARBER: And the final question is -- you know, emphasize here you can't tell us what the phone -- a phone would do tossed out in the woods. That's not your expertise.

5728:55:49

MICAH STURGIS: No, I can't.

5738:55:50

MR. BARBER: But you can tell us how much motion it takes to turn on the screen.

5748:55:56

MICAH STURGIS: Yes, very little motion.

5758:55:58

MR. BARBER: And you've demonstrated that.

5768:55:59

MICAH STURGIS: Several times, yes.

5778:56:01

MR. BARBER: And that feature on the IPhone was active on her phone.

5788:56:05
5798:56:05

MR. BARBER: And it's totally separate from orientation.

5808:56:08

MICAH STURGIS: That's correct, it is.

5818:56:09

MR. BARBER: No further questions.

5828:56:11

JUDGE NEWMAN: Anything further?

5838:56:12

MR. CONRAD: Just a couple things, Your Honor.

5848:56:15

RECROSS-EXAMINATION

5858:56:16

BY MR. CONRAD:

5868:56:17

MR. CONRAD: You did -- you said you reviewed Paul's phone. Did you review the video that's been called the kennel video in this case?

5878:56:23

MICAH STURGIS: Yes, I have seen the video.

5888:56:25

MR. CONRAD: And did you have any information that would lead you to disagree that that video was recorded at 8:44 and about 55 seconds on June 7th?

5898:56:36

MICAH STURGIS: No, I don't have anything.

5908:56:37

MR. CONRAD: And the location data, did you know the location data for that video was recorded at the kennels on the Murdaugh property at Moselle?

5918:56:44
5928:56:45

MR. CONRAD: Okay. All right, and Mr. Barber was talking to you about steps data. And just so it's clear to the jury, and I'm going to speak in hypotheticals here for a second, but if you see the IPhone record steps over an interval of about 5 minutes, for example, it records a certain number of steps over that 5 minutes.

5938:57:03
5948:57:04

MR. CONRAD: Does that mean -- is that phone trying to tell you that someone's uniformly walking at an exact pace that keeps them moving over that entire 5 minutes?

5958:57:10

MICAH STURGIS: No, not necessary.

5968:57:11

MR. CONRAD: Okay. They could stop at some point in the middle of that, correct?

5978:57:14

MICAH STURGIS: That is correct, yes.

5988:57:14

MR. CONRAD: All right, and so they could stop and pick something up in the middle of a period showing steps, correct?

5998:57:19

MICAH STURGIS: That correct. It's just the steps between those two times.

6008:57:22

MR. CONRAD: All right. So, you can't testify, and you can't tell us if between --

6018:57:25

MR. CONRAD: Pull up the steps exhibit real quick. Next slide. All right.

6028:57:29

MR. CONRAD: And looking at entry 28 on Alex's --

6038:57:32

MICAH STURGIS: Entry what? I'm sorry, I couldn't hear you.

6048:57:35
6058:57:35
6068:57:36

MR. CONRAD: Yeah, and between 9:02 and 9:06, we see, what, 283 steps. Is that correct?

6078:57:42

MICAH STURGIS: That's correct, yes.

6088:57:44

MR. CONRAD: All right, and you can't tell us if his phone stopped at any point between those --

6098:57:52

MICAH STURGIS: No, it's just --

6108:57:53

MR. CONRAD: -- what's that, roughly 4 minutes or a little over 4 minutes.

6118:57:55

MICAH STURGIS: No. Just 283 steps between those two times.

6128:57:58

MR. CONRAD: So, he could have walked 200 of those steps in the first 2 minutes and then only walked -- slowed down for the rest of the 2 minutes, correct?

6138:58:05
6148:58:05

MR. CONRAD: Or it could have been vice versa.

6158:58:06
6168:58:07

MR. CONRAD: Or he could have stopped for an entire minute somewhere in there. You can't tell us any different, correct?

6178:58:12

MICAH STURGIS: It would be unlikely to stop for an entire minute. I think if you stop for that long of a period of time, a new entry would be made.

6188:58:18

MR. CONRAD: And do you know, is there a cutoff for IOS?

6198:58:21

MICAH STURGIS: No. I think just based off of what I'm seeing here, for instance, entry 29 and 30, you have about a 3 minute gap there, and -- yeah.

6208:58:33

MR. CONRAD: So, maybe if he stopped for a minute, it would have started a new entry. Is that what you're saying?

6218:58:40

MICAH STURGIS: It could have.

6228:58:41

MR. CONRAD: If he was stopped for a shorter period of time, it wouldn't necessary have, correct?

6238:58:47
6248:58:48

MR. CONRAD: Okay, and finally, Mr. Barber was asking you about a distance, and I think I wanted to make sure I understand -- make sure I understood you correctly. I think you testified that you would consider the actual steps count to be more accurate than the distance. Is that correct?

6258:59:03

MICAH STURGIS: I would, yes.

6268:59:04

MR. CONRAD: Have you found any research or studies that has measured for the accuracy of steps or distance in IOS devices?

6278:59:11

MICAH STURGIS: I have, yeah. And, for instance, I've had cases where the step count and the GPS data is different sometimes.

6288:59:21

MR. CONRAD: Okay, and in your opinion, the steps count is probably more of the most accurate?

6298:59:26

MICAH STURGIS: In my opinion, yeah, the steps count is more accurate.

6308:59:31
6318:59:32

MR. CONRAD: Nothing further from the State.

6328:59:36

JUDGE NEWMAN: You may step down.

6338:59:39

MICAH STURGIS: Thank you, Your Honor.

6348:59:42

(The witness exited the stand.)

6358:59:45

JUDGE NEWMAN: Ladies and gentlemen, that is it for today. We'll resume at 9:30 tomorrow. Please do not discuss the case.

(The jury left the courtroom.)

JUDGE NEWMAN: Anything further on this day?

MR. WATERS: Nothing from the State, Your Honor.

MR. HARPOOTLIAN: Nothing from the defense, Your Honor.

JUDGE NEWMAN: We'll resume at 9:30.

(Whereupon, the case was at ease.)