Britt Dove — Direct/Voir Dire
992 linesMR. CONRAD: State calls Lieutenant Britt Dove with SLED.
The witness, DAVID BRITTON DOVE, was first duly sworn and testified as follows:
COURT CLERK: Have a seat in the witness stand, state your full name again, and spell your last name for the record.
BRITT DOVE: Britt Dove, D-o-v-e. I go by Britt. I'm known as David Britton Dove.
VOIR DIRE EXAMINATION
BY MR. CONRAD:
MR. CONRAD: And Lieutenant Dove, where are you currently employed, sir?
BRITT DOVE: With the South Carolina Law Enforcement Division, known as SLED, in the Computer Crime Center.
MR. CONRAD: All right, and what's your rank?
BRITT DOVE: I am a lieutenant in the unit.
MR. CONRAD: So, you're in the supervisory capacity over the Computer Crimes Unit?
BRITT DOVE: Yes, sir, I am.
MR. CONRAD: Okay, and how long have you worked at SLED?
BRITT DOVE: I began my clear at SLED in June of 2008.
MR. CONRAD: All right, and did you have law enforcement experience prior to working at SLED?
BRITT DOVE: Yes, sir, I did. I began my law enforcement career in December of 1999 with the West Columbia Police Department; I served as a patrol officer and a school resource officer with them. I also started -- was with the Richland County Sheriff's Department for several years as a resource officer, and then I came back to West Columbia as an investigator handling family violence, elder abuse, child abuse, sexual assault investigations before coming to SLED.
MR. CONRAD: And since you've been in SLED, I believe -- did you just say it was 2008 when you started SLED?
BRITT DOVE: Yes, sir.
MR. CONRAD: What have you -- what roles have you filled at SLED since 2008?
BRITT DOVE: When I began at SLED, I began as undercover chat specialist dealing with internet crimes against children, and also doing digital forensics, whether it be computers, cell phones, tablets, at the time GPS systems. From there I moved into the role of working with file-to-file trading of child pornography and dealt with that. And then from there I moved into the role of doing general investigations while continuing to do digital forensics before I became a supervisor.
MR. CONRAD: And you're a supervisor with computer crimes. Is that correct?
BRITT DOVE: Yes, I am.
MR. CONRAD: And just briefly, what exactly does computer crimes do at SLED?
BRITT DOVE: Computer crimes at SLED, they do several things. One, when local agencies submit digital evidence to us, whether it be a laptop, a tower, a tablet, DVR, cell phone, servers, we will go and try to extract the information to look for anything that's relevant to the investigation. We also do handle some investigations. We also do internet and other kind of investigations, along with doing intrusion investigations with servers and ransomware.
MR. CONRAD: Okay. Now, you've talked a little about computer and phone forensics, and that's something you have experience in. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right. Give the jury a brief description, and we'll get into more details later as we go through some of the evidence, but what is computer forensics, and what is phone forensics, and how are they different?
BRITT DOVE: Computer forensics -- when we receive a computer, whether it be a laptop or a tower, it's going to be treated the same way. We're going to attempt to remove the hard drive from it, connect the hard drive to a physical write blocker, which is a piece of hardware that we connect it to; we also use a software write blocker. That way we can extract the information and get a bit by bit forensic copy of all the addressable area on the drive, and then that way -- that's what we work off of is that copy so that we can then do not disturb the original evidence when we're looking to see what's on there. Cell phone forensics are a little bit different. You can't remove necessarily -- especially with the newer ones, you can't go and remove a hard drive from the cell phone. So, many times what we have to do is connect the cell phone to hardware devices, whether it be Cellebrite, GrayKey, AXIOM, or one of the other ones out there. Once we connect it, then we will extract the information from that and then work off the information that's extracted from that in order to do the examinations.
MR. CONRAD: All right, and have you had training over the years in computer and phone forensics?
BRITT DOVE: Yes, sir, I have.
MR. CONRAD: All right. Can you briefly describe to the jury some of the training you've had. A. Yes, sir.
BRITT DOVE: If I may refer to my notes?
JUDGE NEWMAN: Yes, sir.
BRITT DOVE: I am currently a certified Cellebrite operator. I'm a Cellebrite certified physical analyst. I'm certified in -- advanced smartphone analyst with Cellebrite. I'm certified with -- it used to be BlackBag mobilized operator. I'm certified as a black light examiner. And I've also received certification for Axon investigative certified operator and examiner. I'm currently a member of the Secret Service Task Force. I'm also a member of the FBI Cyber Working Task Force, and also the FBI InfraGard, along with the South Carolina Internet Crimes Against Children Task Force. I've received training from Cellebrite. To receive the certifications, I've have been tested on those. I've also received training with the National White Collar Crime Center for basic data recovery and acquisitions, identifying and seizing electronic evidence, encryption, metadata, and nexus tags. Electronic law enforcement seminars. Basic computer schools for law enforcement. Network intrusion response program.
Introduction to cell phone investigations. Virtual currency. Block train -- block chain tracing and crypto currency, anti-money laundering. And the future of preserving digital evidence. I've also attended the National Computer Forensic Institute with the Secret Service and received training in the basic computer evidence recovery, basic networking investigative training, point of cell training, advanced forensics training, network intrusion response program, digital evidence investigation. Mac forensics training. I've also received training from access data known as FTK and the internet forensics. I received training from Texas A&M, their school of engineering extension services through FEMA for forensic -- or digital forensics basics, network assurance information security for everyone. Cyber incident analyst and response. I also received training from HiDock courses Atlanta and Carolinas in social media resource investigations.
BlackBag Technology where I received training to become a certified mobilized operator. Also basic technology for autopsy eight hour online training, which is a forensic tool used for computers. Intro to DFIR, the Divide and Conquer Process. I've attended Magnet Forensics virtual summits for pattern of life analysis, timeline user generated activities. Virtual summit Taking a Bite Out of a Chromebook Analyst. Virtual summit Taking the First Steps into Windows and Memory Forensics. Virtual summit The Evolution of Ransomware Attack, Investigation Response, and Prevention Services. And that's just to name a few. I have several pages of them if you would like for me to read them.
MR. CONRAD: I think that should be sufficient, for now anyway. Have you been qualified as an expert in court before?
BRITT DOVE: Yes, sir, I have.
MR. CONRAD: In what areas?
BRITT DOVE: I've been qualified as a computer forensic expert, and also as a cell phone forensic expert.
MR. CONRAD: All right, and approximately how many times have you been qualified in court?
BRITT DOVE: Six times total.
MR. CONRAD: All right.
MR. CONRAD: Your Honor, at this time the State would seek to introduce Lieutenant Dove as an expert in phone -- cell phone forensics.
JUDGE NEWMAN: What says the defense?
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: All right, ladies and gentlemen, he is so qualified as an expert in the field of cell phone forensics. You may proceed.
MR. CONRAD: Thank you.
DIRECT EXAMINATION
BY MR. CONRAD:
MR. CONRAD: All right, Lieutenant Dove, a few minutes ago you briefly kind of discussed the process of extracting data from cell phones. Is that correct?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: All right. Let's get into a little more detail of that process. First of all, when you receive a cell phone in a locked state, are you able to access the files on that phone?
BRITT DOVE: No, sir. We're not able to access all the files on there.
MR. CONRAD: Why is that?
BRITT DOVE: Because when modern cell phones, when they are in a locked state, the files are encrypted on there. They usually use 256 bit encryption and they're based -- with the Apple Phone, for instance, they're based at a file level of encryption so that you are not able to pull the file out to look at it until you decrypt it or unlock the file.
MR. CONRAD: All right, and once the phone is unlocked, you're then able to access the data, correct?
BRITT DOVE: Yes, sir, we are.
MR. CONRAD: All right. What is a phone extraction, first of all, and then we will -- what is a phone extraction?
BRITT DOVE: A phone extraction would be us retrieving as much information, user information off of that phone as possible. And then once we take that information, it's put into -- depending on the software, a lot of times it's put in a zip file, and we then -- we will process that zip file with another piece of software to go through and decode and look at the information.
MR. CONRAD: And what kinds of information can you get from a phone via an extraction?
BRITT DOVE: There's several different types of extractions. One is an advanced logical extraction, which is kind of the surface level, what you would see on your phone if you looked at it. Then you have full file system extractions. They go deeper, which will get hidden files that you may not see that -- like databases in there that are in the background but you won't see, but yet it contains information. And then the ultimate is a physical extraction. Now, physical extraction involves things whether you're going to root the phone or you were going to jailbreak a phone. And what that means is basically I'm going in and removing all security features from your phone so that now it's wide open and something could happen to it, which we don't practice rooting or jailbreaking phones because it is a huge security risk for the owner.
MR. CONRAD: And I think you kind of mentioned this, but there are different types of phone extractions, correct?
BRITT DOVE: Yes, sir, there is.
MR. CONRAD: And just name a few of them.
BRITT DOVE: There is the advanced logical extraction. Like I described, it's just kind of a surface level that you go through. It's what you see on your phone. If you look at it, you see the text messages, call logs, pictures, things like that. Then you have the file system, which are going to get you databases in there. They're going to get you things that you're not seeing, along with the surface level. And then, of course, you have the physical, which ultimately you can program in ability to a file.
MR. CONRAD: So, there's three general categories for types of extractions. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay. All right, and I imagine in doing this in your computer lab you would have access to multiple types of software to help you extract and process this data off these phones. Is that correct?
BRITT DOVE: Yes, sir, we do.
MR. CONRAD: All right, and what are some -- what's some of the software you use to help you with these phones?
BRITT DOVE: Some of the software we use, we'll use Cellebrite, whether it's their UFED touch, which is a hardware device to extract information. They have a 4 PC version, which it sits on your laptop or your computer, we'll use that to extract. There's also AXIOM by Magnet Forensics that we'll use to extract stuff, too. And then Cellebrite also offers several other things. The one we'll use a lot is GrayKey, which we use to extract information from IOS devices, or from Android devices.
MR. CONRAD: And how do you decide what software to use on what device?
BRITT DOVE: It really depends on what we're looking for and the state of the device when we receive it. If we receive a phone that we have a pass code to that's -- they're just looking for call logs and features, the investigator, sometimes we'll just use Cellebrite 4pc, or physical analyzer, and we'll just do an advanced logical extraction for them. Most of the time, though, we always try to get a full file system because there's additional stuff we can see and look at besides just that surface level stuff. So, if it's an IOS, an Android, sometimes we'll use GrayKey. If it's one of the other ones, sometimes we'll reach out to the Secret Service if we're not able to and use Cellebrite Premium.
MR. CONRAD: Okay, and we'll talk in more detail about each phone later, but in terms of your testimony today, we're going to focus on three different phones, and that is Maggie's, Alex's, and Paul's. You've been able to process all of those phones in your lab. Is that correct?
BRITT DOVE: Yes, sir, I was.
MR. CONRAD: All right. Just for Maggie's phone, what -- for Maggie's, what types of software have you used -- did you use to process her phone?
BRITT DOVE: For Maggie's phone, I used several different softwares. I did the extraction with GrayKey in order to get the full file system like I described. That way it gets more of the databases, more of the surface level stuff. From that I used Cellebrite Physical Analyzer to go in and do the decoding and to analyze and look at the phone and the information on there. I also used AXIOM by Magnet Forensics; I used their tool to help validate what I was seeing with the Cellebrite stuff.
MR. CONRAD: And why do you use the three different types of software in this -- why did you use three different types of software on Maggie's phone?
BRITT DOVE: GrayKey is primarily just an extraction device. It's a piece of hardware like a box that you would connect to and it helps extract the information. It doesn't do any of the decoding, any of the analyzing of it. I used Cellebrite Physical Analyzer to go through to decode and analyze it. What I was finding on that, I wanted to validate that what I was seeing was being decoded properly, was right, so I ran it through a separate piece of software so that I could see if, and it's getting the same information that I know that both are decoding properly.
MR. CONRAD: So, for example, if you find a particular text or photo that has a certain timestamp on using Cellebrite, you want to check on AXIOM to see if it has the timestamp. Is that something you would look for?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And what would that tell you if you saw they had the same timestamp?
BRITT DOVE: If it told me it had the same thing, they would have validated each other that both were working properly and decoding the information properly.
MR. CONRAD: All right, and you received a phone that's been identified -- that you identified as Alex's phone. Is that correct?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: And we'll get into details of you receiving it a little later, but what pieces of software did you use to analyze Alex's?
BRITT DOVE: Alex's phone I used GrayKey to do the full file system extraction. At first I didn't have the password for that phone and then I was able to obtain that password. So, I used it to do the full file system, and then I ran it through Cellebrite Physical Analyzer, and then turned around and used AXIOM to validate my results, make sure they were decoding properly.
MR. CONRAD: Okay, and Paul's phone, which you had -- you've had an opportunity to process as well, correct?
BRITT DOVE: When I received Paul's phone, it had a locked pass code that I was not able to bypass with GrayKey. At the time the software version that was running on the phone, the model of the phone, it would not get a full file system and would not obtain the pass code. So, I reached out to the Secret Service, because they had additional resources, to see if we could use their resources to obtain the pass code.
MR. CONRAD: And ultimately that was successful. Is that right?
BRITT DOVE: Yes, it was.
MR. CONRAD: That was Jonathan VanHouten of the Secret Service?
BRITT DOVE: Yes, sir. That was my point of contact; that's who I took the phone to and signed over to, and then received the phone back, along with the hard drive containing the extraction he performed.
MR. CONRAD: All right, and circle back to Maggie and Alex's phone. You provided pass codes for those two phones. Is that correct?
BRITT DOVE: Originally I was provided a pass code for Maggie's phone. For Alex's phone -- I received two phones at the same time on that case, or within a day or two apart. One was -- from him had a pass code. The other one did not have a pass code with it, but I attempted, because we are creatures of habit, to use the same pass code on both and it worked.
MR. CONRAD: All right. All right. Let's -- you've already referenced this, but let's go back and talk about the kinds of information you pull off of these phones. And there's user accessible information that would normally be accessible by a user of the phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And let's talk -- run through real quick again. What are some examples of that type of information?
BRITT DOVE: That would be call logs, voice mails, photos. If you wanted to pull up and see things you had saved, like your alarms that you had on your clock setting, if you had set any of those, those kind of things you would see on there.
MR. CONRAD: All right, and in a nutshell, that kind of information, if you just opened up the phone itself, that that's kind of the information you would go and see for yourself if you just went through the phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, but there's other types of information on the phone as well.
BRITT DOVE: Yes, sir, there is.
MR. CONRAD: And that's information that a simple user can't necessary access. Is that correct?
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: All right, and tell us more about that information. First of all, where is it stored, how is it stored, and how is it accessed by your -- in your lab?
BRITT DOVE: Phones use many times SQLite databases to store information. They will go in and inside their SQLite databases, there's things we're able to obtain by doing the full file system extraction. And things you may see in that are big ones called KnowledgeC database, you can see if the phone has been turned: it if's in portrait mode, straight up and down, or it's been turned to vertical and landscape mode. You can see if the power goes out on the phone for the power log database, and what kind of battery percentage you might have. You can -- it also will in the encrypted databases, it will have geolocation stuff and GPS stuff. It will contain things like Bluetooth connections where you can see if your phone connected to a Bluetooth device previously, when was the last time it connected to it. And those are some of things you can find in different databases.
MR. CONRAD: All right, and you just used a few words there. First of all, I think you said SQLite.
BRITT DOVE: Yes, sir.
MR. CONRAD: What is that and what does that mean?
BRITT DOVE: SQLite database is a database that's contained -- the best way to think of it is think of just one solid file, all the information contained inside that file. That file will go through and once it fills up, it will delete out oldest stuff and keep the newest stuff. If you think about your phones, you use your phones a lot, usually what's going to start filling up on your phones are photos, videos, music, apps when you put those on there, those kind of things, and you'll start losing size of your phone. Well, the SQLite database, because it's a file, it's not going to continuously grow and eat into all of that space. It's going to take up a certain amount to begin with because it's an operating system, but it stays within that contained file, and that's where the information is. And it's also set up by tables, too. So, you would have to go and look at the different tables to be able to interpret the information.
MR. CONRAD: Okay. Now, those type of databases, I think you just said, are typically self contained.
BRITT DOVE: Yes, sir.
MR. CONRAD: And they don't just keep writing to cover the entire phone memory, do they?
BRITT DOVE: No, sir. If you had a SQLite database like KnowledgeC for example, it's not -- if you just continuously took your phone and went and changed the orientation of it, or you went and started doings things like plugging it into an outlet to charge up, or unplugging it, doing different things like that, it's not going to eat up all of your memory in the phone. Your memory is going to be mainly eaten up usually by photos, videos, apps that you download, things like that.
MR. CONRAD: And is there a shelf life of this type of database information on a phone? Does it override itself over a period of time?
BRITT DOVE: Yes, sir, it does.
MR. CONRAD: Okay, and just generally speaking, how often is that type of database stored on a phone? How long is this for, would you say?
BRITT DOVE: It depends. It depends on how much you use in that database. Some databases will do -- it may override information if you're using a lot within two days. If it's a location like encrypted cache database, it may hold it for 45 days. It's just going to depend how much. Because it's self contained, it needs that room. So, it's always the newest and the oldest app on that database and goes through constantly doing that. So, it depends -- it really depends on how much you're using that database whether you may see something that's 45 days old in there, or you may see something that's two days old or two weeks old.
MR. CONRAD: All right. You mentioned KnowledgeC database. Is that a type of SQLite database?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: All right, and what are the -- some of the things you would expect to find in KnowledgeC database?
BRITT DOVE: Many times in a KnowledgeC database, you'll see different things where you may see orientation changes. You may see if somebody pushes a button on their phone, like a power button, or it used to be home buttons in the older model of IPhones. You could see different things like that. You could also see things that -- also talk with the power log database where it'll show you the percent of battery life you have left. If you plug it in, you start charging it. It will go through and look at all of those kind of different things to see, or just a few of the things to look at.
MR. CONRAD: Okay. All right. You mentioned location storage, and that's a type of KnowledgeC database, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: So, it's not unlimited storage for location points on a phone, correct?
BRITT DOVE: Well, let me correct that. Actually KnowledgeC, you have separate databases that do location.
MR. CONRAD: Okay.
BRITT DOVE: You have the cache database, you have the cache encrypted database just to name a few that will say location information.
MR. CONRAD: And so phones, depending on how the user has their settings, will store location data, correct?
BRITT DOVE: Yes, sir. A user can make a selection on their phones whether they want to always give out their location only when using a Apple IPhone or never. It's a setting that a user gets to choose if they want or it sets by default.
MR. CONRAD: Sorry, and what are the different types of location data that a phone can store?
BRITT DOVE: A phone can store many things. It can store cell towers that it's seen, depending on the database it comes out of. If it's the encrypted cache database, a lot of times it will tell you what networks it's seen but will not tell you the exact date and time that it has seen those networks, but it will tell you at some point in its life it's seen this network at this location. You have the cache database. Many times it will go through, and that will be pulling GPS information. You'll have also databases that will pull cell phone tower information if it's available.
MR. CONRAD: And just, again, generally speaking, would GPS location information be more accurate than something like cell phone tower location information?
BRITT DOVE: Yes, sir, it would be.
MR. CONRAD: Okay. Again, speaking generally, Lieutenant Dove, when you do a phone extraction, are you altering the data that you're pulling off the phone in any significant way?
BRITT DOVE: No, sir, we're not.
MR. CONRAD: Okay, and how do you tell that? How can you know that for sure?
BRITT DOVE: For example, if we use a phone and you use GrayKey to do the extraction on it, it will produce a report, and in the report it will tell us if it was successfully pulling it. It also will give us an MD5 hash value at the end, which is the mathematical algorithm that goes through and computes a very long number with letters and numbers. We can then take the extraction and run our own hash against it for an MD5 and compare it with another tool to make sure those two numbers match, and that means that no data has been altered.
MR. CONRAD: Okay, and have you performed these MD5 comparisons for the three phones we're going to talk about today?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay, and you're confident in telling this jury that nothing you did significantly -- to any of the data that you're going to tell them about today?
BRITT DOVE: Correct.
MR. CONRAD: All right. Let me ask you real quick. What is a Faraday bag?
BRITT DOVE: A Faraday bag is a bag that's used to put items in. It can receive cell phone, Bluetooth connections, WiFi connections, GPS things, it helps to block those items from being received on the device.
MR. CONRAD: Okay, and are there other ways to block a cell phone receiving those types of signals?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what are some of those ways?
BRITT DOVE: You can also place the phone in airplane mode. In airplane mode, when you set your phone to that, you will not be able to receive any WiFi connectivity or a cell phone connectivity in cell towers. You can also remove the SIM. It's another way of ensuring that you're not receiving those things. The difference in airplane mode versus a Faraday bag is the phone will up still being able to receive GPS coordinates.
MR. CONRAD: Okay. All right, and what danger are we concerned about when we talked about putting a phone in a Faraday bag or in airplane mode?
BRITT DOVE: That somebody can wipe the phone remotely.
MR. CONRAD: And specifically when you say somebody, who?
BRITT DOVE: Anybody that would have -- take an IPhone, for instance. If somebody knows a user's I-Cloud name and password, they could get on -- say the IPhone is lost or stolen -- and it will wipe that phone.
MR. CONRAD: Okay. So, somebody has to have the Apple credentials if it's an IPhone. It would have to be that person who could wipe that phone like that, correct?
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: Let me ask you this. Is there a way for someone to remotely alter the phone in any way short than just a full wipe?
BRITT DOVE: You could do it by connecting a phone and doing an I-Cloud backup -- for instance, with a IPhone -- and then you would have to go through and remove whatever you wanted to, and then you would restore that phone to the previous I-Cloud backup you did. And then that way the phone would only go back to that previous state, and that's what it would show you.
MR. CONRAD: Okay, but is there a way to remotely -- other than the process you just talked about, is there a way to remotely access a phone and, say, alter a call log for instance?
BRITT DOVE: No, sir, not that I'm aware of.
MR. CONRAD: All right. Or any other piece of singular data on a phone, is there a way to alter it remotely?
BRITT DOVE: No, sir, not that I'm aware of.
MR. CONRAD: Okay, and in terms of policy for SLED, is it SLED's policy to collect phones and put them in a Faraday bag?
BRITT DOVE: No, sir.
MR. CONRAD: All right. Is there a SLED policy that governs how to collect cell phones from a crime scene or other where -- or from elsewhere?
BRITT DOVE: The manual for evidence collection through the forensic lab discusses taking a phone and placing it into airplane mode if available and removing the SIM card.
MR. CONRAD: All right. Let's talk about time real quick. How does a cell phone time -- how is it set? Let me ask you that. The time you see on a cell phone, how is it set?
BRITT DOVE: Cell phone time is set through the provider. Most of the times the phone will come default. They will auto set to whatever timezone you're in, along with your provider, whether it be T-Mobile, Verizon, it sets through their servers. That way they know how to bill people and they can also check it for usage time, too.
MR. CONRAD: Okay, and is a cell phone kind like my oven where if I set the time and a year later it's, like, 10 minutes off?
BRITT DOVE: No, sir, not usually, unless you went and removed the auto times on it. But then you would see traces of that when you look at it that somebody has changed the time zone, it will go back to the original time zone. Whereas if you drove from South Carolina to Alabama, for instance, right after you cross that state line, within a minute your phone is going to update to that current time zone, which is an hour behind us automatically.
MR. CONRAD: All right, and so when we compare two phones and we compared events on two different phones that occurred, you know, using the same or similar times, are those time references the same?
BRITT DOVE: Yes.
MR. CONRAD: All right, and how are those time references synced?
BRITT DOVE: They're synced through the server. Each phone is going to sync through the server individually, and then when you look at them you can see what time zone they were set in, along with the reports, along with looking to see. And then you can always confirm, if you needed to, maybe like call details records or something else if you want to go another step in validating the call logs versus what it's seeing from the cell phone provider.
MR. CONRAD: Okay. I'm going show you what's in evidence as State's Exhibit 204.
JUDGE NEWMAN: Let's stand for a moment.
(Break in proceedings.)
JUDGE NEWMAN: You may proceed.
MR. CONRAD: Please the court?
MR. CONRAD: All right. I'm going to show you what's been -- this is in evidence as State's Exhibit 204, and I'm going to ask you if you recognize that, sir.
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: All right, and what is that item?
BRITT DOVE: This is an IPhone that we received in case 70210204 -- it was Item 1 -- that, when after being processed, belonged to Maggie Murdaugh.
MR. CONRAD: Okay, and you received that phone. Do you recall when you received that phone?
BRITT DOVE: I would have to check my notes and the actual date. It was in June. I believe it was June of 2021. I received the phone from our evidence intake at SLED.
MR. CONRAD: Okay, and what did you do when you first received the phone and you went to examine it?
BRITT DOVE: When I received the phone, I returned to our unit where our evidence vault is held. I logged the item into evidence. One of the processes we have when we log items in is we take photos of the item as it comes in. If it's got a cracked screen to it, we'll photograph that; if it doesn't have it, we'll photograph that. Once the item then is photographed, we'll go through, we'll process the phone as far as for evidence where we'll go in, we'll look at the phone, we'll pull the SIM card out, if it hadn't been pulled out. We'll check the IMEI number. We'll log it into our system. We'll place stickers on the phone and on the bag itself. Once that's done, then we'll take it to our evidence vault and sign it into a shelf in our evidence vault.
MR. CONRAD: Okay. I'm going to show you what's been marked as State's Exhibit 277. Do you recognize that, sir?
BRITT DOVE: Yes, sir. This is a photo I took when I examined this item.
MR. CONRAD: All right, and that item being?
BRITT DOVE: Item 1, the IPhone belonging to Maggie Murdaugh.
MR. CONRAD: And at this time, the State would move to introduce Exhibit 277 to evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(PHOTO MARKED AS STATE'S EXHIBIT NUMBER 277 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: I'm going to show this. What is this a picture of? What do we see on this picture?
BRITT DOVE: This is a picture of her settings on her IPhone. I opened the settings. I went in and pulled up. It shows the name of Maggie Murdaugh has been entered as a name for the phone. It also shows that the phone has been placed in airplane mode, that the WiFi connection is off, Bluetooth connection is on, cell connection is placed in airplane mode.
MR. CONRAD: Okay. So, this is a picture you took, correct?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: All right, and did you alter any of these settings yourself when you accessed this phone?
BRITT DOVE: No, sir, I did not.
MR. CONRAD: And we see the phone is in airplane mode, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And is that the condition you received the phone?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: And was it -- do you recall if it was powered off when you received it?
BRITT DOVE: It was powered on when I received it.
MR. CONRAD: But it was in airplane mode, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: I'm going to show you State's Exhibit 276. Do you recognize that, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: Is that a picture you took?
BRITT DOVE: Yes, sir, it is. It's one I took during our examination of the phone.
MR. CONRAD: And that's, again, Maggie's phone?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: All right.
MR. CONRAD: And at this time, the State would move to introduce State's Exhibit 276 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: Admitted without objection.
(PHOTO MARKED AS STATE'S EXHIBIT NUMBER 276 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, and real briefly, what is that a picture of?
BRITT DOVE: This is a picture of one of the screens on the phone that shows the different apps on there. It also shows on there that there has been notifications received in those apps such as CVS Pharmacy. It shows little number one there that it has been received, a notification to that app.
MR. CONRAD: All right, and when you see a notification like that, what does that mean to you? What does that tell you?
BRITT DOVE: That they have been -- one, that they had their notifications turned on. Because if you go through and set your apps phone not to notify you, then you won't receive them or see them. That a notification has been turned on for that CVS app, for instance, and that she has received a notification on there.
MR. CONRAD: All right. I'm going to show you what's been marked as State's Exhibit Number 275. And do you recognize that, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: What is that?
BRITT DOVE: This is the location service from Maggie Murdaugh's phone. During my examination I pulled this up, and it shows where there are apps and different things. If, one, location service was turned on, but then two, if it was always running, if it was only while the app was being used, or was set to never.
MR. CONRAD: And at this time, the State would move to introduce Exhibit 275 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted without objection.
(LOCATION SERVICE FOR PHONE MARKED AS STATE'S EXHIBIT NUMBER 275 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: Okay, can you read that, Lieutenant Dove, on the screen?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: All right, and at the top, what is that? What do we see there?
BRITT DOVE: At the top of it on the left-hand side you see the time of 12:30 with a little triangle next to it for location services. Then on the right-hand side, you see the little airplane to indicate the phone is in airplane mode. Then you the see the battery, and it's hard to tell on the screen, but I believe it's yellow. It looks like on there that's it's a low battery. Then it's the location services; it shows that location services are turned on. Then it goes on through several different apps, not all of them, but then shows, like, AccuWeather, is set to never record locations. You've got Amazon, Alexa. That's always the app store only while using the app -- the Apple Store while using the app. Apple Watch Faces while using. Apple Watch Workout while using. And PCBS toolkit while using.
MR. CONRAD: Okay. So, these are user settings that presumably the owner of the phone would have set, correct?
BRITT DOVE: Yes, sir. The majority of the time when you add a new app to your phone, it asks you do you want to allow location services, do you want to allow it all the time, only while using the app, or never. You can also go into your own settings and change those location services.
MR. CONRAD: Okay, and for most of these apps we see on here, it seems to say that location services only to be used while using. What does while using mean?
BRITT DOVE: It indicates when you pull the app up and the app is in use, that that's when it's recording the location that you're at, whether it's running in the background or you pull it up and then close it completely out.
MR. CONRAD: Okay. So, if no one is actively using a particular app, the phone is not going to record location data, correct?
BRITT DOVE: Correct. For that app, yes, sir.
MR. CONRAD: For those settings where it says while using, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: I'm going to approach and show you Exhibit 278. Do you recognize that, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And what is that?
BRITT DOVE: This is a picture of Maggie Murdaugh's phone I took while I was doing the examination of it, and it shows the recent call log.
MR. CONRAD: Okay.
MR. CONRAD: At this time, I would move to introduce State's Exhibit 278.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(PHOTO MARKED AS STATE'S EXHIBIT NUMBER 278 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: And this is the recent call log from Maggie Murdaugh's phone, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: All right, and we see some entries that are red and some that are black. What does that mean?
BRITT DOVE: The red entries on there indicate missed calls, calls that have been received by the phone but were not answered.
MR. CONRAD: And we see the word Alex followed by a numeral five. What does that mean?
BRITT DOVE: That would indicate the phone has recorded that there were five missed calls from the person identified as Alex in that contact list.
MR. CONRAD: Okay, and in addition we see a missed call from Buster, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And two missed calls from John Marvin. Is that correct?
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: And can we see the times or dates on this screen right now?
BRITT DOVE: It shows the date on there as far as the day of the week; it does not show the calendar date or the times.
MR. CONRAD: Okay, and finally I'm going show you Exhibit 279. Do you recognize this?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: What is that?
BRITT DOVE: This is a photo of Maggie's Murdaugh's phone. When I was doing the examination, one of the other things I did was open the messages to look at it and take a photo of that.
MR. CONRAD: Okay, and that's a picture you took, correct?
BRITT DOVE: Yes, sir, I took that photo.
MR. CONRAD: And at this time, the State would move to introduce Exhibit -- State's Exhibit 279 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(PHOTO MARKED AS STATE'S EXHIBIT NUMBER 279 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, and this is the -- those recent messages from Maggie, correct?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: All right, and what types of messages would show up in this inbox?
BRITT DOVE: In this inbox you would receive SMS messages, a regular text message, and also MMS messages, which ones may also have a photo attached to them would show up.
MR. CONRAD: Okay. All right, and I see to the left of most of these a dot. What does that dot indicate?
BRITT DOVE: That dot indicates messages that have not been read or opened.
MR. CONRAD: Okay. So, after you took those processing pictures of Maggie's phone, what did you do?
BRITT DOVE: I continued to process the phone. I took the GrayKey extraction I did with the phone. I ran through Cellebrite Physical Analyzer, went through it and looked for information relevant that may help the investigators, also to see what kind of things were going on the day of June 7, 2021. And then from thereafter, I finished that one. That's when I ran the extraction through AXIOM to try to see if I could validate what I was seeing here.
MR. CONRAD: Okay, and you mentioned it, but this was a full physical extraction on Maggie's phone?
BRITT DOVE: It was a full file system extraction.
MR. CONRAD: A full file system. Okay, and you processed it in Cellebrite?
BRITT DOVE: Yes, sir.
MR. CONRAD: And does Cellebrite produce a full file system report?
BRITT DOVE: Yes, sir, it will.
MR. CONRAD: Okay. What -- explain to the jury what that is and what it does.
BRITT DOVE: A full file system report from Cellebrite is going to have everything that it can decode and then put in a readable format for you. It's going to give you things like your health database stuff, like to show you your steps that you're taking, calls that you've made or missed or received, your emails, your text messages. It's going to tell you if you connected to a Bluetooth device. It's going to tell you if you went and were in a certain area. You have geolocation information such as GPS information. It's also going to tell you if you have mobile payments in there, where you can look and see what cards you have mobile payments just to name a few. It will pull thousands of pages of information if you ran a full one and pulled it. It will also give you the configurations of apps. It will also give you the databases, too, in that report.
MR. CONRAD: Okay, and you just mentioned it, but a full Cellebrite report is rather large, correct?
BRITT DOVE: Yes, sir, depending on the size of the phone and how much information is on the phone. I have seen them run over 148 gigs in size for one report.
MR. CONRAD: What is a gig?
BRITT DOVE: A gig is a measurement that is used for data. Most phones nowadays when you get them are going to go 64 gigs as your smaller end, and they go up near 128 or 256 or even a terabyte now. It's how much data it will hold.
MR. CONRAD: And phones, let's say just new models that -- the phones that Apple is selling, what's a common size that's sold by Apple today?
BRITT DOVE: Most of the time people will acquire 126 or 128 gig size. Then the next size up is the 256.
MR. CONRAD: This full size Cellebrite report that you produced for Maggie's phone, do you recall how large it is?
BRITT DOVE: No, sir, not the full file system I don't.
MR. CONRAD: All right, but it's large, correct?
BRITT DOVE: Yes, sir. It's -- if I remember correctly, it's probably about 68 gigs in total size.
MR. CONRAD: And if you wanted to print everything in that report, could you approximate how many pages it would take?
BRITT DOVE: No, sir. I would venture to guess, looking at the timeline, for instance, in a report like that, you're talking about nine thousands pages just for the timeline section of that report.
MR. CONRAD: Okay. All right. I'm going to show you a box, and I think the marker's on the inside, so you might need to open it up, but it's State's Exhibit 280, and you can open it up. All right, and what is the contents of that box, sir?
BRITT DOVE: The contents of this box is a portable Solid State external hard drive.
MR. CONRAD: Okay, and is that something you've had access to before?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what did you do with that external hard drive?
BRITT DOVE: On this external hard drive, I provided a copy of the file system report from Cellebrite. I placed it on this hard drive.
MR. CONRAD: For whose phone?
BRITT DOVE: This is for Maggie Murdaugh's phone.
MR. CONRAD: All right, and you estimated it was in the neighborhood of about 60 gigabytes. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Plus or minus?
BRITT DOVE: Yes, sir, probably plus that.
MR. CONRAD: And that represents the full file system that you pulled off of the Maggie's phone. Is that correct?
BRITT DOVE: Yes, sir, in a report format.
MR. CONRAD: All right, and the phone is in evidence sitting right there in front of you. Is there any significant difference in the data that's contained on that phone and contained on that hard drive other than the ability to access it?
BRITT DOVE: That's the only difference.
MR. CONRAD: Okay. All right.
MR. CONRAD: Your Honor, at this time the State would move to introduce State's Exhibit 280 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(HARD DRIVE MARKED AS STATE'S EXHIBIT NUMBER 280 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: Lieutenant Dove, we just talked about if we printed all of that, it would be thousands of pages, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: So, for today you've printed shorter reports that we can look at and discuss for Maggie's phone. Is that correct?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: But those reports are pulled from that full Cellebrite report on that hard drive. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: I'm going to show you something that's marked as Exhibit 281. Take a look at that, sir. Do you recognize that?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: What is that?
BRITT DOVE: This is a report, a Cellebrite report from Maggie Murdaugh's phone that was pulled just for call logs with a filter established for just June 5th of 2021 to June 7th of 2021 as parameters for this phone.
MR. CONRAD: And so those are call logs that were stored on Maggie's phone. Is that correct?
BRITT DOVE: Yes, sir, they were.
MR. CONRAD: And explain to the jury real quick -- they heard from a Verizon representative this morning -- what's the difference between call logs stored on that phone and call logs that might be stored by a company like Verizon?
BRITT DOVE: When call logs are stored on the phone, one of the things on this report -- for instance, it will have network unknown. It's not pulling network information. So, it doesn't matter whether you're using T-Mobile or Verizon for your phone. It's still going to pull the call logs. Even if you were to go and switch carriers from Verizon to T-Mobile, it would still pull the calls logs from the database. One of the other things it will do is it will record times that the phone is receiving the call, along with the amount of time that you spend on the call. It will show if it was answered or missed on there.
MR. CONRAD: Okay.
JUDGE NEWMAN: We're going to take a break at this time. Ladies and gentlemen, if you will go to the jury room, we'll take a fifteen minute break.
(A break was taken.)
JUDGE NEWMAN: You may now bring the jury, please.
(The jury returned to the courtroom.)
COURT BAILIFF: The jury is present, sir.
JUDGE NEWMAN: Thank you. You may proceed.
MR. CONRAD: Thank you, Your Honor. May it please the Court, Your Honor?
BY MR. CONRAD:
MR. CONRAD: Lieutenant Dove, I think we were discussing State's Exhibit 281 before the break. Is that correct?
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: And what was that again?
BRITT DOVE: This is a Cellebrite report for Maggie Murdaugh's IPhone extraction, and it has just the call logs for the date range of 6/5/2021 to 6/7/2021.
MR. CONRAD: Okay, and I believe you said it contains information, the date and time that the call was made, correct?
BRITT DOVE: Yes, sir, it does.
MR. CONRAD: Whether it was outgoing or ingoing call, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And whether a call was answered or not. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right.
MR. CONRAD: And at this time, State would move to introduce State's Exhibit 281 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(CELLEBRITE REPORT MARKED AS STATE'S EXHIBIT NUMBER 281 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, Lieutenant Dove, this report is twenty pages long, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And we're not going to go through line by line every call, but I'm going to focus on --
MR. CONRAD: Can I have the ELMO, please?
MR. CONRAD: Let's take a look at Maggie's call log from the night of June 7th. Can you read that from your screen up there, sir?
BRITT DOVE: Yes, sir. I can read down to item 8 on that.
MR. CONRAD: Okay, and actually we're going to go back a little more. Okay. All right, and let's look at line 14 on this report. Do you see that, sir?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: And, first of all, when I say line 14, what am I referring to on there?
BRITT DOVE: On the left-hand side of the picture there is a column, and when you build a report it adds the numbers just to make it easier to keep track of in that report. If you added this report with another piece of item, whether it's text messaging or voice mails, it would change the numbers.
MR. CONRAD: Okay, and on line 14, what is that data entry? What does that represent?
BRITT DOVE: It represents a call that was outgoing on this phone.
MR. CONRAD: All right, and we see a number. Don't read the number, but we see a number and a name below it in the second column there. Is that correct?
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: And what's that name?
BRITT DOVE: Barbara.
MR. CONRAD: Okay, and did you say that this is on outgoing call or ingoing call?
BRITT DOVE: It shows the direction as an outgoing call.
MR. CONRAD: Okay. Now, I look at line 13 and I see another entry that says Barbara. What is that?
BRITT DOVE: That is the same call. It's entered in two different databases, and it pulls from both databases because it's both call logs.
MR. CONRAD: All right, and so there's two databases for call logs on this -- on Maggie's phone. Is that what you're saying?
BRITT DOVE: Yes, sir.
MR. CONRAD: And just briefly, what does that mean, there's two different logs?
BRITT DOVE: There's multiple -- there's several different SQLite databases in a phone, and it's going to contain the information in different places. One may be recent calls. One may be calls that are considered past the recent step that's set in the database so that it's going to be in the call logs, but it's not going to be in the recent. Sometimes you'll see them in both databases, recent and the call logs.
MR. CONRAD: All right. Okay. All right, and so that -- what time was that call that you see on the entry there, line 13 and line 14?
BRITT DOVE: At line 13, it's on 6/7/2021 at 7:50, 19 seconds p.m. minus 4 UTC.
MR. CONRAD: Okay. So, that's 7:50 p.m. Eastern time, correct?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: And in the next column we see a number and it says 2:46. What does that mean?
BRITT DOVE: That is the duration of the call.
MR. CONRAD: Okay. So, at 7:50 p.m. Maggie placed a call to Barbara, is that correct, that lasted 2 minutes and 46 seconds?
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: And we see a slight time difference between line 13 and line 14, it's about four seconds, and that's just simply the different way the different logs record the data?
BRITT DOVE: Yes, sir. It's because they're going into different databases, so there is a lag in that.
MR. CONRAD: But your testimony today is what is the exact time that call was placed to Barbara?
BRITT DOVE: That call was placed to Barbara at 6/7/2021 at 7:50 and 19 p.m.
MR. CONRAD: Okay. All right. In your review of Maggie's call logs, was this the last answered -- or excuse me, the last phone call that was either dialed or answered by someone on Maggie's phone?
BRITT DOVE: I would have to check the logs again --
MR. CONRAD: Sure.
BRITT DOVE: -- but I believe so.
MR. CONRAD: I'll let you have it back.
BRITT DOVE: Yes, sir, that's correct. That's the last answered call, or one that was shown in the direction of outgoing.
MR. CONRAD: All right. No more outgoing calls that night, correct?
BRITT DOVE: No, sir, correct.
MR. CONRAD: And no more answered calls the night of June the 7th. Is that correct?
BRITT DOVE: Correct.
MR. CONRAD: Okay. We're going to look at lines 9 and 10, and let me know if you can see that on your -- I've got it reversed, my bad. Okay. Let's look at lines -- and I can't quite see line -- you can see line 10, correct?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: And there's a staple there, but above that it should be line 9, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and then we also see lines 11 and 12, correct?
BRITT DOVE: Yes, sir, we do.
MR. CONRAD: All right, and what do lines 11 and 12 show?
BRITT DOVE: They show that the phone from Maggie Murdaugh received a phone call from 1-803-942-1227. On line 11 it has the name Alex associated with it. It shows the direction as incoming.
MR. CONRAD: Okay, and was that call answered?
BRITT DOVE: No, sir.
MR. CONRAD: Okay, and again we see two line entries for the same call. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: However, there is a difference. One line is -- line 11 says Alex and line 12 says PA. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: But they're the same number, though, correct?
BRITT DOVE: Yes, sir, they are.
MR. CONRAD: And, again, briefly explain why we see a Alex and a PA between those two lines?
BRITT DOVE: Because there are two separate databases that these are entered into. And when you set up your contact list, you can go through and if you wanted to set a name for either a spouse, a child, or a good friend, you can set it how you want it to be, and that's going to show up from the contact side of it.
MR. CONRAD: Okay, but it's the same call, correct?
BRITT DOVE: Yes, sir. It's the same call, same phone number that it was received from.
MR. CONRAD: Okay. Let's look at line 10 and 9 directly above that, and again, the 9 is slightly obscured, but what do we see there? What activity does those two lines represent?
BRITT DOVE: Those two lines show calls from 1-803-942-1227. Line 10 has it as PA, direction shows an incoming call, and it shows it as a missed call.
MR. CONRAD: And again, it's Alex and PA, but it's the same number ending in 1227, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And you've had an opportunity to examine a phone associated with 1227, correct?
BRITT DOVE: Yes, sir, I have.
MR. CONRAD: And whose phone is that?
BRITT DOVE: That was Alex Murdaugh's.
MR. CONRAD: And, again, that time is what?
(Break in proceedings.)
MR. CONRAD: All right, and the two times we see in line 10 and 9, can you read those times and those two blocks? And are they the same?
BRITT DOVE: Yes, sir, they are the same. It is 6/7/2021 at 9:06:14 p.m., UTC minus four.
MR. CONRAD: Okay, and that's local time 9:06, correct?
BRITT DOVE: Yes, sir, that's local time.
MR. CONRAD: And 14 seconds, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and let's read the times for line 11/12. That's the first call from Alex. What are the times for the call that's associated with lines 11 and 12?
BRITT DOVE: They're the same time. It is 6/7/2021 at 9:04:23 p.m., UTC minus four.
MR. CONRAD: All right. We're going to talk about a few more lines here. Let's talk about lines 7 and 8 on this report, and what does this information show?
BRITT DOVE: It shows a phone call of 1-803-942-1227. On line 7 it has the name of Alex, direction shows incoming, and it shows it was a missed call received on 6/7/2021 at 9:06:51 p.m., UTC minus four.
MR. CONRAD: All right, and again, those are two lines associated with the same call, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and so just reviewing, within the space about 2 minutes you see three separate calls from Alex's phone incoming to Murdaugh -- excuse me, Maggie's phone. Is that correct?
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: All right, and after that 9:06:51 call on line 7 and 8, what's the next call you see on this log?
BRITT DOVE: Moving up the call log, the next call I see is from 1-803-942-1227 on line 5. It has the name of Alex. The time received on that call is at 9:45:32 p.m., UTC minus four.
MR. CONRAD: And that's lines 5 and 6, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: On the same call, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And then finally let's talk about lines 3 and 4. What information do you see there?
BRITT DOVE: On lines 3 and 4, they're the same call from 1-803-942-1227. On line 4 it shows it as PA, direction is an incoming call, and it was received at 10:03:58 p.m., UTC minus four, as a missed call.
MR. CONRAD: All right, and to clarify, these last five calls from Alex's -- Alex, were any of them answered?
BRITT DOVE: No, sir.
MR. CONRAD: And previously we looked at --
(Break in proceedings.)
MR. CONRAD: When you took pictures of Maggie's phone, you took a picture of her call log, correct?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: All right, and I'm showing you -- again I'm going to put it up on the screen as being admitted Exhibit 278, and we saw that numeral five next to Alex's name, correct?
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: And that represents five missed calls.
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: And I don't know if you were doing math while we went through that. We can look at it again if you would like, Lieutenant Dove, but did you count the calls from Alex that were missed in a row as we went through that call log?
BRITT DOVE: Yes, sir. I came up with five.
MR. CONRAD: Okay, and since I have that picture up there, when you accessed Maggie's phone to take these pictures and to go through some of these screens, did you change any settings?
BRITT DOVE: No, sir. The extraction had already been done at the point I took these photos.
MR. CONRAD: Okay. So, the extraction actually was done before these pictures?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, but even after, did you change any settings or open up any calls to make any difference on the phone?
BRITT DOVE: No, sir, I did not.
MR. CONRAD: Okay. Just looking at Maggie's call log on the phone itself again -- this is still 278 -- we see -- we talked about calls with Barbara that were at 7:50 p.m. on the call log, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And looking at this screen we see a call before that, before Barbara. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And who is that name on that call?
BRITT DOVE: Mary Anne.
MR. CONRAD: Okay, and was that a completed call.
BRITT DOVE: Yes, sir. It shows as a completed call, not a missed call.
MR. CONRAD: Okay, and can you look at the screen, and maybe you can't -- can you tell from this screen itself whether it was an incoming or outgoing call?
BRITT DOVE: No, sir. I cannot tell for sure from the screen.
MR. CONRAD: If we looked at it on the call log we just talked about on Exhibit 281, you would be able to tell that information, though, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay. All right. Okay. So, let's move on. Let's talk about Maggie's text message report. I'm going to show you something that's marked as Exhibit 282. Do you recognize that, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: What is that?
BRITT DOVE: This is a Cellebrite report that I produced from Maggie Murdaugh's phone that has text messages with a filter that, that was set from June 7, 2021, to June 7, 2021, for just the daytime, one day's worth of text messaging.
MR. CONRAD: And what kind of information does that report have on it?
BRITT DOVE: General information it has, on the beginning of the report it's going to have information about the device as far as the apple ID and what the name is that's associated with the phone and the type of phone, just general data as far as the device information. On the other pages you'll see text messaging that's on the phone, who they were from, the text message, the dates, and also show the status, if it was read or an unread message.
MR. CONRAD: And when you look to see if it was read or unread, if a message had been read, would the phone record that time and date the message was read?
BRITT DOVE: Yes, sir, it does.
MR. CONRAD: At this point, the State is going to move to introduce State's Exhibit 282.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
MR. CONRAD: Thank you, Your Honor.
(TEXT MESSAGE REPORT MARKED AS STATE'S EXHIBIT NUMBER 282 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right. Now, let's talk a lit bit about how the text messages were organized in this report. Is it strictly chronological through?
BRITT DOVE: No, sir, not always. Sometimes they can get a little out of order, depending on when -- the text messaging and the filters you set on the report.
MR. CONRAD: Okay, and how did you set this up on the report? And I'll give it back to you to look at.
BRITT DOVE: On this report it pulled -- it appears to have pulled chronologically, but it's also pulling instant messages versus chat messages, and they are coming from different databases.
MR. CONRAD: Okay. So, if it came from a different database it's separate, but if there are -- but all the SMSs should be in chronological order, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right. So, let's look at a few texts here. Okay, this is page 31 of this report. Can you read that at the bottom there? Is that readable?
BRITT DOVE: Just part of the bottom is readable.
MR. CONRAD: Sorry, I was looking at the wrong one. Okay, and what is this?
BRITT DOVE: This is -- appears to be a group text message that was received on this phone from one individual to several other individuals.
MR. CONRAD: All right. Let's not read numbers, but some of these -- most of these have names to them, so who sent this message?
BRITT DOVE: It appears it has it down as John Marvin.
MR. CONRAD: And who else is in this text group?
BRITT DOVE: Maggie Murdaugh is -- appears in this, but it has her user account name which is a Yahoo email address. It has Alex, Christy, Lynn, Allen, Liz, and it has one phone number that doesn't have a name associated with it.
MR. CONRAD: Okay. All right, and what time did this text message arrive on Maggie's phone?
BRITT DOVE: It appears that the text message was received 6/7/2021 at 8:31 0 seconds p.m., UTC minus four.
MR. CONRAD: Your Honor, I think without defense objection the State is going to move to seal this per the evidence protocol.
MR. HARPOOTLIAN: Your Honor, I understand that is to protect the phone numbers and email addresses of the other folks on there. We have no objection.
JUDGE NEWMAN: Is that correct?
MR. HARPOOTLIAN: No objection to sealing the phone numbers, Your Honor.
JUDGE NEWMAN: Okay.
MR. CONRAD: Okay. Now, real quick, again, what time did that text arrive on Maggie's phone?
BRITT DOVE: It shows in the bottom of it 6/7/2021 at 8:31 p.m. UTC minus four.
MR. CONRAD: Okay. All right, and was that text message read?
BRITT DOVE: Yes. It shows it as read.
MR. CONRAD: Okay, and what time was it read?
BRITT DOVE: It shows it as read on 6/7/2021 at 8:31:16 p.m., UTC minus four.
MR. CONRAD: So, about 16 seconds later, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Can you read this text message, please?
BRITT DOVE: Yes, sir. It says: I plan to go over to visit Dad tomorrow afternoon. Is anyone else planning to go?
MR. CONRAD: All right, and that's from John Marvin, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And we're not going to go back and look at the previous texts in this thread, but what is the general, just, topic that they're discussing just for context for the jury?
BRITT DOVE: It appears that they are talking about going to visit Dad tomorrow and trying to find out if anybody else plans to go over with him and at any time.
MR. CONRAD: All right, and this is a response to a series of texts about Randolph, Alex's dad, and his health, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And I'm going over to page 32, and we see another text. And this is that same text group, correct?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: And this is another text that arrived on Maggie's phone, correct?
BRITT DOVE: Yes, sir, it did.
MR. CONRAD: Who sent that text?
BRITT DOVE: It looks like Lynn G.
MR. CONRAD: All right, and what does it say?
BRITT DOVE: It says: I'm in court all week. With an emoji.
MR. CONRAD: Okay. Was this text read?
BRITT DOVE: Yes, sir. It shows it as read at 8:49:27 p.m., UTC minus four, on 6/7/2021.
MR. CONRAD: Okay, and I'm going to hand this report back to you and have you help me find -- I believe Maggie receives a text later and it might be from Rogan. Could you find that text in there for me, please?
BRITT DOVE: Yes, sir. Yes, sir, I found -- I've located it.
MR. CONRAD: And what time did that text arrive on the phone?
BRITT DOVE: That text arrived on 6/7/2021 at 9:34:14 p.m., UTC minus four.
MR. CONRAD: All right. Let me see. All right, and that text is from who?
BRITT DOVE: That text, it says it's from Rogan.
MR. CONRAD: And that's at least what the apps -- or, excuse me, the contact list says.
BRITT DOVE: Yes, sir. That's the name that was entered in the contact list associated with that phone number.
MR. CONRAD: And that arrived on Maggie's phone when?
BRITT DOVE: On 6/7 of 2021 at 9:34:14 p.m., UTC minus four.
MR. CONRAD: And was that text ever read?
BRITT DOVE: No, sir. It appears as a status of unread.
MR. CONRAD: Okay. Now, let's be clear about something, Lieutenant Dove. Now, when we say a text is read or a call is answered, can you know for certain from your forensic analysis of who the actual person was who answered a call or made a call or read a text?
BRITT DOVE: No, sir. I cannot tell you who did it. I can tell you the phone has the information, the phone recorded certain information, but I can't tell you who is actually touching the screen or pushing the buttons on it.
MR. CONRAD: Okay. All right, but in order to place a call or to place a text or to read a text, what condition has to be satisfied --
(Break in proceedings.)
MR. CONRAD: All right, we'll continue for now. Where was I? What condition has to be satisfied in order for someone to make a call on a phone?
BRITT DOVE: Unless you're making an emergency call, like a 911 call, you would need to know the pass code to be able to unlock the phone to get to the contact list, or either to the number pad to dial the number.
MR. CONRAD: All right. So, you need to know, A, the pass code, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: To unlock the phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Are there other ways to lock the phones or unlock these phones?
BRITT DOVE: There is also to with IPhones, which this one was. There's the biometric way of doing it. If you set a face unlock, where instead of having to enter your pass code every time, you can look at it and the camera will activate and then it will unlock via face.
MR. CONRAD: All right. I'm going to show you -- I believe there's some texts from Alex that Maggie received that night. Can you find those in that report, sir?
BRITT DOVE: Yes, sir. Yes, sir, I found the text thread.
MR. CONRAD: Okay. All right. Let me -- all right. Let's look at page 16, and can you read that, sir?
BRITT DOVE: Are you referring to the bottom text on that one?
MR. CONRAD: Yes.
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: Okay. All right, and who is that text from?
BRITT DOVE: It's from Alex.
MR. CONRAD: All right, and who -- it was sent to Maggie's phone, correct?
BRITT DOVE: Yes, sir, it was.
MR. CONRAD: All right, and what time did that arrive on Maggie's phone?
BRITT DOVE: It shows 6/7 of 2021 at 9:08:58 p.m., UTC minus four.
MR. CONRAD: Okay, and was that text ever read?
BRITT DOVE: No, sir. It shows the status as unread.
MR. CONRAD: And I can hand you back the report if you need to refer to it again, but we previously discussed a text at 8:49 and 27 that -- from Lynn G, I believe, that was read, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Is there any text that arrived on Maggie's phone after that time that were read?
BRITT DOVE: No, sir, there was not.
MR. CONRAD: Okay. I'm going to hand you what's been marked as State's Exhibit 282, and I'm going to ask you if you recognize that, sir.
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And what is that?
BRITT DOVE: This is a Cellebrite report that I produced from Maggie Murdaugh's phone. It has on there device events from her phone with a date range filter placed on it for the day of 6/7/2021.
MR. CONRAD: Okay. All right, and what kind of information is contained in that report?
BRITT DOVE: In this report it's going to be different information in there. As far as activity, it will have location information in there. It will also have whether the phone was unlocked, if it was locked, if there's orientation changes. It will also pull if it was plugged in whether to a car or to the wall to charge.
MR. CONRAD: And these are -- this is all -- most of this is information that's stored in those databases we discussed previously, correct?
BRITT DOVE: Yes, sir. Most of this information is on the KnowledgeC database.
MR. CONRAD: Okay.
MR. CONRAD: Beg the Court's indulgence.
MR. CONRAD: And how many pages is this report?
BRITT DOVE: I can't remember offhand. I think it could -- I can't remember if that's the 87 page report that I produced for that one.
MR. CONRAD: Okay. Okay. I'm going to direct your attention, if you can read that, to line 4336. Do you see that at the bottom, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And what information is contained on line 4336?
BRITT DOVE: It has -- the first column has the number, then it has device events. The next column that's populated has a date of 6/7/2021, 8:17:15 p.m., UTC minus four start time. Then the column two columns over, it has unplugged, and this information was obtained from the KnowledgeC database.
MR. CONRAD: What does unplugged mean?
BRITT DOVE: It would indicate that the phone was unplugged whether from a vehicle or from a wall or a computer that that was charging.
MR. CONRAD: All right, and I'm going to show you again State's 283. And you previously explained that is a report you prepared off of Maggie's Cellebrite phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And there's a time on there for it, correct?
BRITT DOVE: Yes, sir, the device events.
MR. CONRAD: And at this time, the State would move to introduce 283 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(CELLEBRITE TIMELINE REPORT MARKED AS STATE'S EXHIBIT NUMBER 283 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: Okay, I'm going to direct your attention to line 4354. Can you see line 4534 (sic).
BRITT DOVE: Yes, sir, I can see 4354.
MR. CONRAD: And what's the date and time associated with that log?
BRITT DOVE: 4354, the date associated is 6/7/2021 at 8:30:23 p.m., UTC minus four.
MR. CONRAD: And what is that data entry?
BRITT DOVE: That entry shows Poshmark Buy and Sell Fashions.
MR. CONRAD: Would that be a website?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what does that indicate to you was occurring on this phone at that point?
BRITT DOVE: That it was possibly running in the background.
MR. CONRAD: Okay. Would this be a website that had been previously accessed on this phone?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay. I'm going to show you a series of entries starting at 4404 here. I want to see if you can read that up there. Can you read 4404?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and above that is 4403, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what is that line entry that we see at 4403?
BRITT DOVE: It is -- it shows that the display was on, and that was obtained from the KnowledgeC database.
MR. CONRAD: Okay, and then in that -- this is all on June 7 of 2021, correct?
BRITT DOVE: Yes, sir, and the time on that one is at 8:49:20 p.m, UTC minus four, it shows as a start time.
MR. CONRAD: Well, let's talk about that for a minute. Display on, what does that mean?
BRITT DOVE: It's when your screen lights up. It's the easiest way I can describe it. And there can be a variety of reasons why it would light up.
MR. CONRAD: All right. Well, let's talk about some reasons. Why don't you list some, please?
BRITT DOVE: If you receive a notification, whether it's a call, a text message, if you have it set to receive notifications from an app, like the CVS app that was previously on there, you receive those notifications. Your screen, if it's -- your phone is sitting down not being used, it'll light up to let you know that you received a notification. It can also receive -- it can light up if you have too much vibration sometimes. If you're, you know, walking around tossing your phone up and down, sometimes it can light up. There's various reasons why -- what could cause it to light up.
MR. CONRAD: Could bumping the phone light up the screen?
BRITT DOVE: Yes, sir, it can.
MR. CONRAD: Could picking a phone up light up the screen?
BRITT DOVE: Yes, sir.
MR. CONRAD: So, of those reasons you gave, some of them sound like there could be human cause, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And some of them sound like could be processes that are on the phone itself and requires no external human interaction, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right. So, bumping a phone, that's a human interaction if someone physically bumps a phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: But if a notification comes in and the screen lights up, is that something necessarily that the user caused?
BRITT DOVE: Yes, sir.
MR. CONRAD: So, it could just happen on its own.
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay. So, let's look at line 4404, the line below that, and I think we've got the date established, but what time is that line at -- excuse me, on line 4404?
BRITT DOVE: It shows a time of 8:49:26 p.m., UTC minus four, as a start time.
MR. CONRAD: Okay, and what kind of data entry is that?
BRITT DOVE: It appears to be a SMS, or a text message that the phone was processing.
MR. CONRAD: Okay, and then below that on line 4405 we see a device event, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And at the same time, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what does it say?
BRITT DOVE: It says that -- that was the 44 -- I mean, the 8:49:26 p.m. is an end time, and it shows device locked.
MR. CONRAD: Okay. Well, let's look at 4406 below it. What kind of event is that?
BRITT DOVE: That shows an event of the device unlocked.
MR. CONRAD: Okay. So, the phone is unlocked at 8:49:26, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay, and then line below that, 4407, we see the display is back on, correct?
BRITT DOVE: Yes, sir, it shows display on.
MR. CONRAD: All right. Well, what did we just previously talk about that happened at 8:49:27?
BRITT DOVE: That's when a text message was received.
MR. CONRAD: Was it received or read at that point?
BRITT DOVE: I would have to go back and look in the report. I believe it was read.
MR. CONRAD: Okay. It was read?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay, and so when you see this sequence of events on this timeline log, what would you associate that with, knowing the fact that there was a text message read at that time?
BRITT DOVE: That a text message was received on the phone, that the phone was unlocked to read the text message.
MR. CONRAD: Okay, and I think I might find that report, again which is just to refresh your memory, 279 -- 282, my apologies. Just to refresh your memory, why don't you go back and look at that event at 8:49:27. I believe it was the text thread from the family members.
BRITT DOVE: Yes, sir, I found it.
MR. CONRAD: And what time did that text message arrive on the phone?
BRITT DOVE: It arrived at 8:31:47 p.m.
MR. CONRAD: All right, and what time is it read?
BRITT DOVE: It's read at 8:49:27 p.m.
MR. CONRAD: Okay, and so -- just so we don't get things confused or mixed up, that text message had been on the phone for quite -- for a few minutes anyway by that point, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, but it wasn't read until 8:49:27, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right. Let's keep going here for a minute. All right, let's look at line 4409. Do you see that line on your screen, sir?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay, and what is this line? What does this represent?
BRITT DOVE: This is a line that indicates the start of an orientation change of the phone.
MR. CONRAD: Okay, and what is an orientation change?
BRITT DOVE: An orientation change would be if you take your phone -- it's considered portrait if you're holding it straight up. If you turn it to the side, it's considered landscape, and that would be changing the orientation of it from straight up to sideways.
MR. CONRAD: So, what can cause an orientation change?
BRITT DOVE: It would have to be somebody moving the phone. As far as if I'm holding my phone up to talk to somebody or to look at something on the screen and then I would hold it down by my side, it's going to cause it to change orientation. Or if I rotated my hand to watch a video, it's going to cause an orientation change.
MR. CONRAD: So, could picking up a phone to read a text message cause an orientation change?
BRITT DOVE: Yes, sir, depending on where you're holding it to start with.
MR. CONRAD: And can you think of any process on a phone that will cause an orientation change to a log other than a human holding the phone?
BRITT DOVE: No, sir, not that I've seen.
MR. CONRAD: Well, one possibility let me ask you about is say a phone is dropped. Could that cause an orientation change?
BRITT DOVE: It would have to tumble end over end, like down steps for instance, and it would have to be on to be able to record that orientation change.
MR. CONRAD: Okay. All right. Let's go down to line 4412. Do you see that, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And what does that line show?
BRITT DOVE: That line shows that -- the start time of the device being locked.
MR. CONRAD: Okay, and what time is that?
BRITT DOVE: It's at 8:49:31 p.m., UTC minus four.
MR. CONRAD: All right, and I can hand this phone to you, or excuse me, this report back to you, and we'll come back to this -- that line again in a minute, but I'm going to have you look through this report. So, the phone was locked at 8:49:31, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Can you look in that report and determine if at any point later that night the phone was unlocked?
BRITT DOVE: I do see on here where it does show the lock stage ended on 6/8/2021 at 1:10:35 p.m., UTC minus four.
MR. CONRAD: All right, and that's the next day, correct?
BRITT DOVE: Yes, sir. That's the next afternoon at 1:10 p.m.
MR. CONRAD: Okay. So, that phone was locked between 8:49:31 and 1:10 p.m. the next day, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay. All right, and I'm going to go right back and look at line 4414 -- excuse me, 4413. We just discussed 4412, which was the phone being locked at 8:49:31, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Do you see any entries -- what time is the next entry on this report?
BRITT DOVE: Could you repeat which number you're looking at?
MR. CONRAD: On line 4412, we see the phone is locked at 8:49:31, which is what you just testified to, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: What time is the next event on this log?
BRITT DOVE: The next event on the log shows display off at 8:53:08 p.m.
MR. CONRAD: Is there anything that occurred on this report between those two times on this phone?
BRITT DOVE: Not on the device activities report, the device event report.
MR. CONRAD: Okay, and at 8:53:08, what do we see?
BRITT DOVE: We see that it's the end time for the display off.
MR. CONRAD: Okay, and that's line 4413?
BRITT DOVE: Yes, sir.
MR. CONRAD: And then we see at 4414 what happened?
BRITT DOVE: It's an orientation change.
MR. CONRAD: Then at 4415 what happens?
BRITT DOVE: The display comes on.
MR. CONRAD: Okay. You just said it was an orientation change, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what does that from your expert opinion tell you is going on with this phone?
BRITT DOVE: It's an end time for an orientation change from landscape. In my opinion, the phone is going from being landscaped, being held like this in a position like this to going into a portrait position, which is up.
MR. CONRAD: And you previously testified that there's only a very small number of things that can cause an orientation change, correct?
BRITT DOVE: Correct.
MR. CONRAD: And it's most likely that that's a human caused event, correct?
BRITT DOVE: Correct.
MR. CONRAD: However, you can't testify to today as to who held that phone at that time, correct?
BRITT DOVE: Correct.
MR. CONRAD: And let's keep going here for a little bit. We're at 8:53:12 -- or excuse me, 8:53:24, and that's line 4417. What do you see again?
BRITT DOVE: It shows an end time for orientation change from portrait.
MR. CONRAD: Okay, and then we see at lines 4418 and 4419, we see the display come on and off, correct?
BRITT DOVE: Yes, sir. It shows the end time and display on, and then it shows the start time and the display off.
MR. CONRAD: All right. We'll go to the bottom of that page. We'll look at lines 4428 and 4427. What do you see there, sir?
BRITT DOVE: On 4428 it shows the start time at 8:54:40 p.m. of the orientation change to landscape. At 4429 it shows the end time, which is at 8:54:44 p.m., orientation change from landscape.
MR. CONRAD: And my apologies, I meant to direct you to lines 4426 and 4427. What do you see in those lines?
BRITT DOVE: On those lines it shows at 8:54:34 p.m. It shows a start time of the camera and the phone.
MR. CONRAD: And how long is that camera on for that you can tell?
BRITT DOVE: It appears to be on for 59 seconds or -- yes, 59 seconds. I'm sorry, one second.
MR. CONRAD: One second?
BRITT DOVE: I'm sorry. Doing math sometimes gets me.
MR. CONRAD: It's okay. All right. So, that camera is on for one second. In your opinion, what does that tell you is happening on this phone?
BRITT DOVE: It appears the phone is being moved, and the camera is activating in the background to see if it would recognize somebody's face that would unlock it.
MR. CONRAD: So, the phone is attempting to face unlock, correct?
BRITT DOVE: Yes, sir, that's what it appears.
MR. CONRAD: But you just testified that after a 8:49:31, the phone never unlocked, correct?
BRITT DOVE: Correct.
MR. CONRAD: So with this camera entry, does the phone successfully unlock?
BRITT DOVE: No, sir.
MR. CONRAD: Now, can you tell us what this camera was looking at? Do you have any data that would suggest specifically what the camera was looking at?
BRITT DOVE: No, sir, I don't know what the camera was being pointed at.
MR. CONRAD: So, you can -- it could be looking at the ground?
BRITT DOVE: Yes, sir.
MR. CONRAD: The sky?
BRITT DOVE: Yes, sir.
MR. CONRAD: Somebody's face other than Maggie Murdaugh?
BRITT DOVE: Yes, sir.
MR. CONRAD: But if that camera had seen Maggie Murdaugh's face, what would you expect to happen?
BRITT DOVE: I would expect for it to unlock.
MR. CONRAD: Okay. Let's keep going. All right, let's look at line 4434, and this is at time 8:55:32. What do you see there, sir?
BRITT DOVE: It shows the end time for orientation portrait, which means it was ending in that orientation.
MR. CONRAD: Okay. So, again at that time would it be your opinion that phone was held in somebody's hand?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay, and let's look real quick at the bottom of that page, and that's line 4441. And what is that information there?
BRITT DOVE: In 4441, it comes from the activity sensor data, and that is at 9:00 even p.m., and it shows steps. It also shows distance traveled.
MR. CONRAD: Okay, and let's talk about the steps for a minute. You've produced another report that specifically focused on steps that you've pulled from this phone, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And that shows more granular data of when steps occurred than this report shows, correct?
BRITT DOVE: Correct.
MR. CONRAD: And so just because we see 9:00 on this report, does that mean that steps occurred exactly at 9:00 on this phone?
BRITT DOVE: No, sir. It's the two after the 9:00 on that, which means it would be a range as far as -- an example would be like nine to ten for the total steps.
MR. CONRAD: And you prepared another report that would show specific steps during a specific time range, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay. Let's keep going. All right, let's look at line 4447. What do you see there?
BRITT DOVE: 4447 shows from the call log database an incoming call at 9:04:23 p.m.
MR. CONRAD: Okay, and was that -- who was that call from?
BRITT DOVE: It's from phone number 1-803-942-1227 PA.
MR. CONRAD: All right, and that's the call that we discussed in Maggie's specific call log, correct?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: And that's at 9:04:23 correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Was that call answered?
BRITT DOVE: No, sir. It showed no time that that call was answered.
MR. CONRAD: All right, let's look at the bottom of that page, line 4454, at 9:06:12. What do we see there?
BRITT DOVE: At 9:06:12 shows the start time and an orientation change to portrait.
MR. CONRAD: Okay, and again, in your opinion, what does that tell you about whether this phone is in someone's hand?
BRITT DOVE: In my opinion it would be in somebody's hand, and it was changing it from landscape up to portrait, lifting it.
MR. CONRAD: And that's at 9:06 and 12 seconds, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Let's go to line 4456. Can you read that, sir?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: Okay, and line 4457. What is line 4456 and 57 associated with?
BRITT DOVE: They're associated with a phone call that was incoming to Maggie's phone.
MR. CONRAD: Okay, and what is the time on that call?
BRITT DOVE: It's at 9:06:14 p.m.
MR. CONRAD: Two seconds after that orientation change, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that call came after the orientation change, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And again, you can't tell us whose phone -- your digital forensics can't tell us whose hand that phone was in at that point.
BRITT DOVE: Correct.
MR. CONRAD: All you can tell us was the phone was locked at that point, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: I'm going to hand this back to you and I want you to review this report, and I want you to tell us if that is the final orientation change at 9:06:12 or not. See if you see any further orientation changes after that point.
BRITT DOVE: I do see the end time for the orientation of portrait that are recorded.
MR. CONRAD: Okay, and what time was that?
BRITT DOVE: It was at 9:06:20 p.m.
MR. CONRAD: Okay, and when you say end time, what do you mean?
BRITT DOVE: It's just the time that it recorded that it stopped recording in portrait mode.
MR. CONRAD: Don't let me interrupt. Please finish.
BRITT DOVE: I'm sorry. I was going to say I don't see any orientation change to landscape after this report.
MR. CONRAD: Okay. So, at 9:06:12 the orientation change starts, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: At 9:06:14 there's an incoming call from Alex, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And after that point, you do not see anymore orientation changes, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right. Let me direct your attention -- excuse me, you talk about the 9:06:20 orientation end time, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And then we see at line 4461 another incoming call, correct?
BRITT DOVE: Yes, sir. That was at 9:06:51 p.m., and that was from 1-803-942-1227 PA.
MR. CONRAD: And that's Alex's phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that's the third phone call within about 2 minutes from Alex, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and I see an entry at line 4464 at 9:07. Do you see that, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: All right, and that's a display on and off, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And we've already discussed there could be a number of reasons for that display coming on and off, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And the data you see on the phone is not going to be able to tell you exactly why that screen came on, will it?
BRITT DOVE: Correct.
MR. CONRAD: All right. Line 4466, what is this?
BRITT DOVE: 4466 shows a text message received incoming at 9:06 -- or sorry, 9:08:58 p.m. from the phone number 1-803-942-1227, Alex to Maggie Murdaugh.
MR. CONRAD: And what does that text say?
BRITT DOVE: It says: Going to check on M, be right back.
MR. CONRAD: All right. Let me put you on the spot here. That call occurred at 9-0 -- the last call from Alex occurred at 9:06:51, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And the text came from Alex at 9:08:58, correct?
BRITT DOVE: Yes.
MR. CONRAD: And this was a text that was never read, I believe you testified to, in the previous report, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: All right. I'm going to put you on the spot here. Can you calculate the time between 9:06:51 and 9:08:58, please? Take your time. If you need a pen --
BRITT DOVE: It appears to be 2 minutes and 7 seconds.
MR. CONRAD: There's 2 minutes and 7 seconds between that call from Alex to that text from Alex, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: Thank you. Okay. Let's look at lines 4465 and above it and -- excuse me 4468, and above that is obscured because it's stapled, but 4467. Do you see those two entries?
BRITT DOVE: Yes, sir.
MR. CONRAD: And we see that's -- excuse me, mobile SMS at 9:08:58. Is that a data entry that's associated with that incoming text from Alex we just talked about?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: And what time is that again?
BRITT DOVE: It's 9:08:58 p.m.
MR. CONRAD: Okay. What's the next entry on that log?
BRITT DOVE: The next entry on the log is at 9:31:44 p.m. It shows an end time of display off.
MR. CONRAD: Okay, and I'm not going to ask you to do the precise math this time, but roughly how many minutes is that between 9:08:58 and 9:31:44?
BRITT DOVE: Approximately 22 minutes.
MR. CONRAD: For 22 minutes nothing happens on that phone, correct?
BRITT DOVE: Correct.
MR. CONRAD: There's no orientation changes, the phone is not unlocked, there's no incoming calls, nothing outgoing, correct?
BRITT DOVE: Correct.
MR. CONRAD: The phone just sits there for approximately 22 minutes.
BRITT DOVE: Correct.
MR. CONRAD: What do we see start happening at 9:31:44?
BRITT DOVE: We see that the display comes on as the start time of that.
MR. CONRAD: All right, and we've talked about this already. We will go forward a little bit. We see the displays come on and off a few times in that short span of time at about 9:31 p.m., correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: But it's just a display coming on. Do you see anything associated with that display coming on?
BRITT DOVE: No, sir, not until approximately the 9:34:14 p.m.
MR. CONRAD: We'll get to that in a second, but at least for this display coming on there seems to be no cause for that, correct?
BRITT DOVE: Correct.
MR. CONRAD: And you previously testified that the screen coming on doesn't tell you a whole lot, does it?
BRITT DOVE: No, sir.
MR. CONRAD: It could be that the phone is being bumped or moved in some way, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: It could be that the phone was just sitting there and there is some sort of automatic process that causes that phone to light up, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right, let's talk about -- and you started talking about it, where we see an instant message on line 447 -- excuse me, 4477, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that's at what time?
BRITT DOVE: That's at 9:34:14 p.m.
MR. CONRAD: And which contact is that from?
BRITT DOVE: It shows the contact of Rogan.
MR. CONRAD: All right, and what does that text message say?
BRITT DOVE: It says: Tell Paul to call me.
MR. CONRAD: All right, and you previously testified about this in her text message log. Was that text message ever read?
BRITT DOVE: No, sir.
MR. CONRAD: All right, and we're going to skip down a little bit, and now I'm on line 4498 -- yeah, 98. And we see there it looks like an incoming call, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And who is that from?
BRITT DOVE: It is from PA with the phone number of 1-803-942-1227.
MR. CONRAD: Okay, and was that called answered?
BRITT DOVE: No, sir.
MR. CONRAD: And line 4503, what time is that entry?
BRITT DOVE: That entry is at 9:47:23 p.m.
MR. CONRAD: All right, and what is that?
BRITT DOVE: It's a text message that was received on that from Alex, it says: Call me, babe.
MR. CONRAD: Okay, and was that text ever read? I know that's referencing the previous report.
BRITT DOVE: No, sir, that text was not read.
MR. CONRAD: I'm going to hand this report back to you, and I want to have you look at the next, if you pages. What I -- I want you to tell this jury whether you see anything in your expert opinion that would indicate that anybody actively used that phone after that last text call.
BRITT DOVE: Not on 6/7 of 2021.
MR. CONRAD: Okay. Okay. I'm going to hand you what's been marked as State's Exhibit 284. Take a look at that and tell us what it is, please.
BRITT DOVE: This is an AXIOM report by Magnet Forensics that I prepared for Maggie's phone with health data information and steps.
MR. CONRAD: Okay. So, that includes steps from Maggie's phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: At this time, the State would move to enter it into evidence.
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: It's admitted.
(AXIOM REPORT MARKED AS STATE'S EXHIBIT NUMBER 284 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right. I think I'm going to direct you to record 22, if I'm looking at the right thing. Record 23, excuse me. All right, record 23. What information does this record tell us?
BRITT DOVE: This record tells us that 38 steps were recorded by this phone on 6/7/2021 at -- 8:17:41 p.m. was the start time, and the end time was 6/7/2021 at 8:18:29 p.m.
MR. CONRAD: All right, and how many steps were taken at that time?
BRITT DOVE: 38 steps.
MR. CONRAD: And this was the -- this is a report that shows the precise time when the steps -- at least the phone reported when the steps started and when they stopped, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right, let's talk about that for a minute. Steps on a phone. How does a phone report steps? How does it decide that there are steps taking place?
BRITT DOVE: It's several different ways it can record. It's depending on how the phone is carried as to how many steps it records. If you carry a phone in your hand and you walk, it's going to record more steps. If you carry it on your waist on a phone case, it's not going to record as many steps because it's not detecting the motion. It's not 100 percent accurate as far as the steps. There are ways that if you're trying to meet your fitness goal, for instance, you can try to trick a phone or Smart Watch into believing you did more activities and more steps than you actually did.
MR. CONRAD: Okay. So -- but in a more fundamental level, what is the phone using to determine whether the steps are taking place?
BRITT DOVE: It's a process running inside the phone and it's recording the motion.
MR. CONRAD: What does it use to record the motion?
BRITT DOVE: As far as --
MR. CONRAD: Would it be accelerometers?
BRITT DOVE: It would -- a lot of times it would be. Some of the newer ones are recording actually more than that as far as recording strides and things like that, the newer versions.
MR. CONRAD: All right, and in your opinion, you know, the steps that a phone records, is it always 100 percent accurate?
BRITT DOVE: No.
MR. CONRAD: And so this says 38 steps. Does that necessarily mean that whoever was holding this phone actually moved exactly 38 steps?
BRITT DOVE: No, sir.
MR. CONRAD: But what does it tell you in a more general sense?
BRITT DOVE: In a more general sense it tells me that this phone, somebody was holding this phone and took steps and recorded steps.
MR. CONRAD: All right, and let me reference back to the previous report. I believe you testified that at 8:17 Maggie's phone was unplugged, correct?
BRITT DOVE: Yes, sir, it was.
MR. CONRAD: All right, and then at 8:17 we start to see steps again, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, let's look at record 25. All right, and what does this show, record 25?
BRITT DOVE: This shows that 43 steps were recorded by the phone. At 8:30:40 p.m. was the beginning, and it ended at 8:33:28 p.m.
MR. CONRAD: Okay. All right, and let me point out something real quick. The entry above that, which is record -- I don't think there's a record number associated with it, but it says 8:10 -- yeah, I see an entry at 8:10:31 just above that record 25. What is that entry at 8:10:31? Do you see that?
BRITT DOVE: At 8:10:31 it looks like it's part of a previous record from the previous page. It shows the duration of -- in minutes of 4.58.
MR. CONRAD: Okay, and so some of these are a little bit out of chronological order, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: But the times that are recorded at each record is accurate, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Even if some of these entries seemed to have gotten out of order, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Can you explain why that happened when you made this report?
BRITT DOVE: I set it to produce in chronological order. Sometimes, though, when the report goes through it will not do that. It's just an issue we've had with that report where it will move it out of chronological order, but the information is still there and still accurate.
MR. CONRAD: Let's look at record 26. What do you see in record 26?
BRITT DOVE: In record 26 I see that 59 steps were recorded by the phone at 8:53:15 p.m., begin, and end at 8:55:32 p.m.
MR. CONRAD: Okay, and, again, how many steps was that?
BRITT DOVE: It was 59 steps.
MR. CONRAD: And I think you previously testified when we were looking at the timeline it looked like someone was manipulating with that phone, correct?
BRITT DOVE: Correct.
MR. CONRAD: You saw some orientation changes, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: All right. We saw the camera come on at approximately that time, correct?
BRITT DOVE: Correct.
MR. CONRAD: But the phone is locked, correct?
BRITT DOVE: Correct.
MR. CONRAD: I want to give this back to you, the report, and have you look at it real quick. And you've also, I know, have studied this phone data in more detail than just in that report. Are you aware after that 8:53 entry of that phone ever recording any more steps?
BRITT DOVE: No, sir. The next set of steps it shows it recorded was on 6/8/2021 at 3:12:22 p.m.
MR. CONRAD: Okay. The next day?
BRITT DOVE: The next day, yes, sir.
MR. CONRAD: And let's circle back to that real quick. I know you were not present for the collection of Maggie's phone. Is that correct?
BRITT DOVE: Correct.
MR. CONRAD: But generally the circumstances, as you understand them, are what and how it was collected?
BRITT DOVE: The phone was collected from the side of the road. It was given to crime scene, who brought it back and logged it into our forensic lab, at which point I went over, logged it out of the forensic lab, and then took it over to our office to log it in.
MR. CONRAD: And it was -- but it was not collected until the next afternoon, correct? Or found until the next afternoon, excuse me.
BRITT DOVE: Correct. My understanding is that it was found on 6/8/2021.
MR. CONRAD: All right.
JUDGE NEWMAN: Are we at a good stopping point?
MR. CONRAD: I think we're at a good stopping point.
JUDGE NEWMAN: All right, ladies and gentlemen, we will adjourn for the evening and start back at 9:30 tomorrow morning. Please do not discuss the case.
(The jury left the courtroom.)
JUDGE NEWMAN: Anything before we adjourn?
MR. WATERS: Nothing from the State, Your Honor.
MR. HARPOOTLIAN: Nothing from the defense.
JUDGE NEWMAN: All right. We'll resume at 9:30.
(Whereupon, the case was at ease.)