Britt Dove — Direct/Cross/Redirect/Recross
1,810 linesWEDNESDAY, FEBRUARY 1, 2023
(Court resumed at 9:37 a.m.)
JUDGE NEWMAN: Good morning. Anything before we bring the jury in?
MR. CONRAD: Nothing from the State, Your Honor.
MR. HARPOOTLIAN: Nothing from the defense.
JUDGE NEWMAN: Bring the jury.
(The jury returned to the courtroom.)
COURT BAILIFF: The jury is present, sir.
JUDGE NEWMAN: Thank you. Good morning.
(Jurors respond good morning.)
JUDGE NEWMAN: Day number eight. State's case. You may continue.
MR. CONRAD: Thank you, Your Honor. Lieutenant Dove.
The witness, DAVID BRITTON DOVE, remained under oath and continued testifying as follows:
JUDGE NEWMAN: You're still under oath, sir.
BRITT DOVE: Yes, sir.
CONTINUED DIRECT EXAMINATION
BY MR. CONRAD:
MR. CONRAD: Good morning, Lieutenant Dove.
BRITT DOVE: Good morning.
MR. CONRAD: All right, we were talking about Maggie's phone at the end of the evening last night, correct?
BRITT DOVE: Yes, sir, we were.
MR. CONRAD: All right. Before we move on, I want to cover just a couple more quick things and then we'll move on. I'm going to show you State's Exhibit 283 again, and this was the detailed timeline for Maggie's phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And I'm going to flip to, let's see -- my apologies. Okay. Line 4529. Take a look at 4529, please, and I'll put it up on the screen.
BRITT DOVE: Yes, sir.
MR. CONRAD: All right.
MR. CONRAD: And we'll need the ELMO, please.
MR. CONRAD: Can you read 4529 on the screen?
BRITT DOVE: It's at the very bottom.
MR. CONRAD: Okay. Can you read that, sir?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: All right, and this is a log entry, correct?
BRITT DOVE: Yes, sir. This appears to be a log entry from the data usage SQLite database.
MR. CONRAD: Okay, and in the far right column there, what does that say?
BRITT DOVE: In the far right column as I look at it, it says com.Apple.datausage.findmyIPhone, and then it's got WiFi in 0, Wi-Fi out 0.
MR. CONRAD: And what time did that data entry occur on Maggie's phone?
BRITT DOVE: That data usage entry occurred at 10:05:13 p.m.
MR. CONRAD: And what does that tell you in your opinion?
BRITT DOVE: That in the background, Find My IPhone was using data on the phone.
MR. CONRAD: Okay. Does this information or any information you've looked at in your investigation tell you exactly why the data was used at that time?
BRITT DOVE: No, sir. It could have just been a background app that was running that had been open from previously in the day.
MR. CONRAD: Could it have been that Find My IPhone was being triggered from elsewhere?
BRITT DOVE: It could have been.
MR. CONRAD: Okay, but you can't tell for certain in your opinion.
BRITT DOVE: No, sir. I cannot tell if it was running in the background or if somebody was accessing it.
MR. CONRAD: Okay. Thank you. All right, and again referencing Maggie's phone, one thing that we've not talked about yet is any location data or any location points from that night, have we?
BRITT DOVE: No, sir.
MR. CONRAD: All right, and, in fact, in your analysis of her phone, at least for the night in question, did you discover any precise GPS location points?
BRITT DOVE: From which -- there are several different databases that location information would be from. From the cache database, I didn't find anything for that night. It looks like previously from the examination that she used a map to go to an appointment or to a location, and that information was obtained.
MR. CONRAD: Okay, and that was from the afternoon, correct?
BRITT DOVE: Yes, sir. That was from earlier in the day.
MR. CONRAD: All right, but at least in terms of precise GPS location for that night, your investigation didn't find any on her phone, correct?
BRITT DOVE: No, sir.
MR. CONRAD: And I'm going to show you -- again, I'll put it up on the screen. This is in evidence, State's 275. All right, and this is -- we've talked about this yesterday, but this is Maggie's location services, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And what did we talk about for the majority of apps we see on this screen? How are the location settings set?
BRITT DOVE: For the ones pictured on the screen there's -- the majority of them are set to while using.
MR. CONRAD: And so in your opinion, knowing that and knowing what you've investigated in her database, why don't we see a lot of location data on her phone for the night in question?
BRITT DOVE: It could have been from those apps not being accessed, whether running in the background from previous in the day, or not being cleared out, or not started at a particular time in that day.
MR. CONRAD: So, Maggie's phone was not continuously recording location information, correct?
BRITT DOVE: Not from the apps and the cache database it wasn't.
MR. CONRAD: All right, but you don't have anything in that cache database, correct?
BRITT DOVE: Not from that day, no, sir.
MR. CONRAD: Because while she's out at Moselle, would she have been using her map to navigate?
BRITT DOVE: No, sir.
MR. CONRAD: Okay. All right. So, her phone was fairly well locked down when it came to location, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay. All right. We'll move on. I'm going to show you what's been marked for -- this has been marked as State's 285 and ask you to take a look at this, please. And what's that item, sir?
BRITT DOVE: This item is an Apple IPhone. It was submitted to me with a SIM card and a black case on it.
MR. CONRAD: All right. When was it submitted to you?
BRITT DOVE: In September of 2021.
MR. CONRAD: All right, and have you had an opportunity to examine that phone?
BRITT DOVE: Yes, sir, I have.
MR. CONRAD: All right, and in your examination, were you able to determine who owns that phone?
BRITT DOVE: Yes, sir. According to the account information I obtained from that phone, it belongs to Alex Murdaugh.
MR. CONRAD: All right.
MR. CONRAD: Your Honor, at this time State would move Exhibit 285 into evidence.
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: It's admitted.
(IPHONE MARKED AS STATE'S EXHIBIT NUMBER 285 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, I'm going to showing you State's -- what has been previously marked as State's Exhibit 286, and you might need to open up the box to take a look at it.
(Break in proceedings.)
MR. CONRAD: Did you take a look at it? I'm sorry.
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: And what is inside that box?
BRITT DOVE: Inside that box is a portable solid state external drive that I received and placed a copy of the Cellebrite extraction from Alex Murdaugh's phone.
MR. CONRAD: Okay, and so in your examination of Alex's phone, you did an extraction, correct?
BRITT DOVE: Yes, sir. I did a full file system extraction.
MR. CONRAD: Using what software?
BRITT DOVE: I used GrayKey to collect the extraction, then I processed it and decoded through Cellebrite Physical Analyzer, and also AXIOM by Magnet Forensics.
MR. CONRAD: And you then placed a full copy of the Cellebrite report on that hard drive, correct?
BRITT DOVE: Minus several things. Due to the fact that Mr. Murdaugh is an attorney, there was a privilege review done, so we were -- I was only able to put on there things that were not removed by our attorney for retaining purposes.
MR. CONRAD: And SLED had an attorney who did a privilege review, correct?
BRITT DOVE: Yes, sir, they did.
MR. CONRAD: And several things were removed, and several communications were removed, correct?
BRITT DOVE: Yes, sir. It's my understanding they were removed for attorney/client privilege.
MR. CONRAD: All right, and obviously because you aren't part of the privilege review, you don't know exactly what was removed.
BRITT DOVE: Correct.
MR. CONRAD: However, when it comes to Alex's call log, did you consult with the SLED attorney to determine whether any items were removed from Alex's call log?
BRITT DOVE: Correct. None of the calls were removed. It mainly consisted of text messaging, emails, things of that nature that would actually be the communication, not calls.
MR. CONRAD: Okay.
MR. CONRAD: And at this time, the State would move to enter Exhibit 286 into evidence.
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: It's admitted without objection.
(EXTERNAL HARD DRIVE MARKED AS STATE'S EXHIBIT NUMBER 286 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, and I'm going to show you Exhibit 287. Take a look at that, sir. Do you recognize that?
BRITT DOVE: Yes, sir, I do. This is a copy of the Cellebrite extraction from Alex Murdaugh's phone that just contained call logs the day the filter was placed on this report for May 1, 2021, to June 30, 2021.
MR. CONRAD: All right. Okay. All right.
MR. CONRAD: At this time, the State would move to enter Exhibit 287 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted without objection.
(CELLEBRITE EXTRACTION MARKED AS STATE'S EXHIBIT NUMBER 287 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, let's take a look at Alex's call logs.
MR. CONRAD: And, Your Honor, I don't know if the defense has any objection, but the State would move to place this under seal to protect the phone numbers that might appear.
MR. BARBER: No objection, Your Honor.
MR. CONRAD: Okay, and if we could remove the screen for the audience, please.
JUDGE NEWMAN: Let me see the exhibit.
MR. CONRAD: Yes, sir.
JUDGE NEWMAN: For the privacy of the phone numbers on there, it's under seal.
MR. CONRAD: Okay, and I'm going to show you this exhibit. Let's take a look at line 39. Can you see that?
BRITT DOVE: No, sir, I cannot.
MR. CONRAD: All right. There we go; that should do it. All right, can you see line 39?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: Okay, and what is that?
BRITT DOVE: It appears to be a call that was received on 5/30/2021 at 5:25:25 p.m. and answered. It looks like a FaceTime call.
MR. CONRAD: Okay, and that was on May 30th, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, let's look at line 38 and 37. What are those?
BRITT DOVE: Line 38 and 37 are both calls. They show outgoing as far as the number that phone dialed to another number on June 4, 2021. The first one on line 38 is at 3:41:34 p.m. It shows not answered. It was a FaceTime call, and on line 37 the time on that call, the same individual, was 4:35:56 p.m. It shows not answered as a FaceTime call.
MR. CONRAD: Okay. Let's look at line 36. What is that?
BRITT DOVE: Line 36 is a telephone call that was placed by this phone. It was outgoing is the direction it was placed on June 7, 2021, at 10:25:49 p.m. It shows not answered. It shows a FaceTime call.
MR. CONRAD: Wait a minute. So, we have a call from June 4th, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And then another call at 10:25. It's June 7th, the night of murders, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: But you testified yesterday on Maggie's phone you saw several incoming calls beginning at about 9:02, correct?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: And are those calls in this call log on Alex's phone?
BRITT DOVE: No, sir, they are not.
MR. CONRAD: All right, let's talk about data that's restored -- or retained on phones, and we talked a little bit about SQLite databases yesterday, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And the SQLite databases, for the most part, tend to keep information for only certain periods of time, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Now, is a call log, a phone call log that type of database?
BRITT DOVE: It's a different style of database. It's not recording information as quickly as, say, orientation changes or GPS location stuff because you don't place calls constantly every day every 2 minutes or more. If you did, then you would see it get overwritten and taking out of the older stuff as new stuff comes in, but people don't make calls that much, so for that reason it lasts longer in there.
MR. CONRAD: Okay. So, the call log lasts longer than other types of information on a phone, correct?
BRITT DOVE: Yes, sir. Typically it does just because that's not used as often.
MR. CONRAD: And as a call log builds up, it might eventually -- old calls might eventually drop off, correct?
BRITT DOVE: Yes, sir, older calls will drop off.
MR. CONRAD: But that would be a pretty -- with the phone's available memory, that would be a pretty long list before they started to drop off, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and here we see just simply a gap. We see calls from May of 2021, and then there's a couple of calls on June 4th of 2021, and then nothing until 10:21 p.m., the night of the murders, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: Is that -- can the database simply overriding itself explain that gap?
BRITT DOVE: A gap like that would indicate that it was actually removed from there.
MR. CONRAD: Okay. So, as if a call log were to fill up and start overriding itself, it would override the oldest items first, you just said, correct?
BRITT DOVE: Yes, sir. It's a standard thing with databases like that. Usually the first in is going to be the first out.
MR. CONRAD: Okay, and here we see older calls from May, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And then calls -- a couple of calls on June 4th, and then at 10:25 p.m. we start to see calls again, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that gap when you say removed a second ago, how can those calls be removed to create such a gap?
BRITT DOVE: For a call to be removed, you can go in and very easily go to your call log, if you chose to, and you can swipe it if you move it to the left, that number, it will pop up red on the right-hand side and say delete, and if you choose to delete that call you could do that. The same way you could with text messaging, voice mails, other things that you have access to, user access to.
MR. CONRAD: Is there any way other than that which you just described that you're aware of that could -- any process that could explain that gap in call records on Alex's phone?
BRITT DOVE: No, sir.
MR. CONRAD: So, those calls were deleted, correct?
BRITT DOVE: It would appear that way from based off of looking at the reports and the examination of the phone.
MR. CONRAD: And one last question about that. In the far right column where we -- of these calls we see source of FaceTime. What does that mean?
BRITT DOVE: It was a FaceTime call using the IPhone versus dialing the number.
MR. CONRAD: And when you pulled this report, if there were normal phone calls, would they've simply been left out? Is that possible?
BRITT DOVE: It -- I pulled it for all call logs, so it should have pulled any regular calls also along with the FaceTime.
MR. CONRAD: Okay, and you got Alex's phone when again?
BRITT DOVE: I got it in September of 2021.
MR. CONRAD: Okay. So, that was a full three months after -- approximately there, approximately a full three months after the murders, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay. So, can you testify today of when you think those calls were removed with any information?
BRITT DOVE: No, sir, I cannot.
MR. CONRAD: Okay. So, at some point between when those calls were placed on the night of June 7th and when you got the phone in September, those calls disappeared off that phone, correct?
BRITT DOVE: Those calls were not on the phone anymore. How it happened, I don't know.
MR. CONRAD: Okay. Did you do anything in your investigation, in your extraction or analysis, to potentially remove those calls?
BRITT DOVE: No, sir, I did not.
MR. CONRAD: I'm going to show you State's Exhibit 288.
BRITT DOVE: Okay.
MR. CONRAD: All right. Do you recognize that, sir?
BRITT DOVE: Yes, sir. This is a copy of a Cellebrite extraction report that was done for messages from Alex Murdaugh's phone.
MR. CONRAD: And you prepared that report?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that report is from the data contained on that hard drive from the full Cellebrite report?
BRITT DOVE: Yes, sir.
MR. CONRAD: At this time, the State would move to enter Exhibit 288 into evidence under seal to protect the phone numbers displayed on it.
JUDGE NEWMAN: What says the defense?
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: Are you able to submit a redacted copy deleting phone numbers at a later time for the record?
MR. CONRAD: We could probably make that happen, Your Honor. It will probably take some manual work but we could do that.
JUDGE NEWMAN: All right. You may proceed.
(CELLEBRITE EXTRACTION REPORT MARKED AS STATE'S EXHIBIT NUMBER 288 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right. I'm going to have you flip in this report, Lieutenant Dove. Previously when we looked at Maggie's phone, you testified about a group text that occurred at approximately 8:31 p.m. that night of the night of June 7th?
BRITT DOVE: Yes, sir.
MR. CONRAD: I'm going to have you flip to those texts. Alex was a part of that group text message, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And specifically we're looking for the texts that occurred at 8:31 p.m. that night.
BRITT DOVE: I see it.
MR. CONRAD: Okay. You see it?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay, and I'm going to show on this, the text that arrived on Alex's phone at 8:31 p.m. Can you see that on your screen, sir?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: All right, and this is the same text that we saw on Maggie's phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and that arrived at what time?
BRITT DOVE: That -- it shows it arrived on June 7, 2021, at 8:31 p.m.
MR. CONRAD: Okay, and we're not going to go through the same -- read the list of individuals, but these are the same individuals that were in the group text we saw on Maggie's phone, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And quickly read this text again. What does it say?
BRITT DOVE: I plan to go over to visit Dad tomorrow afternoon. Is anyone else planning to go?
MR. CONRAD: All right, and what time -- date and time was that text read on Alex's phone?
BRITT DOVE: It shows read June 8, 2021, at 1:44:49 p.m.
MR. CONRAD: So, that's the next day?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and we're going to go to the next text in this thread. Can you read that?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: All right. Okay. This should be the correct one. Can you make that out?
BRITT DOVE: Yes, sir. I can make out what the text says.
MR. CONRAD: All right, and what time did this text arrive on Alex's phone?
BRITT DOVE: The text arrived June 7, 2021, at 8:31:47 p.m.
MR. CONRAD: All right, and what does this text say again?
BRITT DOVE: It says: I'm in court all week, with an emoji.
MR. CONRAD: And that's the text from Lynn G?
BRITT DOVE: Yes, sir.
MR. CONRAD: And when was that text read?
BRITT DOVE: It was read on June 8, 2021, at 1:44:49 p.m.
MR. CONRAD: Okay. So, I'm going to go a little bit earlier in the day on those texts. What time -- the text that you see on the screen, what time did it arrive on Alex's phone?
BRITT DOVE: It arrived June 7, 2021, at 4:48:23 p.m.
MR. CONRAD: And just read the text for us again, or read the text for us, please.
BRITT DOVE: It says: Room 632, nurse says we can alternate visits with only one person in at a time.
MR. CONRAD: And who sent that text?
BRITT DOVE: It looks like John Marvin Murdaugh.
MR. CONRAD: All right, and what time was that text read?
BRITT DOVE: It shows read June 7, 2021, at 5:10:32 p.m.
MR. CONRAD: All right. So, that's within about 20 minutes. Is that roughly correct?
BRITT DOVE: Yes.
MR. CONRAD: And let's look at the next text in this same group. What time did this text arrive on Alex's phone?
BRITT DOVE: It arrived June 7, 2021, at 4:48:48 p.m.
MR. CONRAD: And what time was that text read?
BRITT DOVE: It shows read June 7, 2021, at 5:10:32 p.m.
MR. CONRAD: So, again, roughly about 20 minutes after it arrived on the phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And I'm going to have you find this. Yesterday you testified on Maggie's phone about a text that was from Alex at approximately 9:08:58, and I believe the text said something to the nature of I'm going to see M or something like that. Can you find that text in this report, please?
BRITT DOVE: Yes, sir, I did.
(Break in proceedings.)
BRITT DOVE: I've located the message.
MR. CONRAD: All right. Okay, and we see that text, and this was an outgoing text, correct, from Alex's phone?
BRITT DOVE: Yes, sir. It shows the status as being sent.
MR. CONRAD: All right, and what time was it sent?
BRITT DOVE: It was sent on June 7, 2021, at 9:08:58 p.m.
MR. CONRAD: And read the text again.
BRITT DOVE: It says: Going to check on M, be right back.
MR. CONRAD: And we'll go to the text just after that in this thread, and this was another sent text, correct?
BRITT DOVE: Yes, sir. The status is showing as a sent text.
MR. CONRAD: All right, and what time was this text sent?
BRITT DOVE: It was sent on June 7, 2021, at 9:47:23 p.m.
MR. CONRAD: And what does the text say?
BRITT DOVE: The text says: Call me, babe.
MR. CONRAD: And I'm going to ask you to find a text that Alex sent, I believe the contact is called Rogan, at approximately 10:24 p.m. Can you find that for us, please?
BRITT DOVE: Yes, sir.
(Break in proceedings.)
BRITT DOVE: Okay. I've located it.
MR. CONRAD: Okay. What time was this text sent?
BRITT DOVE: This text shows it was sent on June 7, 2021, at 10:24:43 p.m.
MR. CONRAD: And this was sent to Rogan, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And what does the text say?
BRITT DOVE: It says: Call me.
MR. CONRAD: I'm going to show you what's been marked as State's Exhibit 289. I want to ask if you recognize this.
BRITT DOVE: Yes, sir. This is a Cellebrite report that I prepared with timeline events for Alex Murdaugh's phone. The date filter was sent for this June 7, 2021.
MR. CONRAD: All right.
MR. CONRAD: At this time, the State would move to enter Exhibit 289 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(CELLEBRITE REPORT MARKED AS STATE'S EXHIBIT NUMBER 289 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: And the State would ask that Exhibit 289 be under seal because there's some phone numbers displayed for privacy.
MR. BARBER: No objection.
JUDGE NEWMAN: Okay.
MR. CONRAD: And I'm going to show you what's been marked as State's Exhibit 290. Do you recognize that document, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And what is that document?
BRITT DOVE: This is a copy of the Magnet Forensic AXIOM report that I prepared for Alex Murdaugh's phone to show health database steps and movement.
MR. CONRAD: Okay.
MR. CONRAD: At this time, the State would move to enter Exhibit 290, 2-9-0, into evidence. It does not need to be under seal.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(AXIOM REPORT MARKED AS STATE'S EXHIBIT NUMBER 290 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: We're going start looking at the steps first so this screen can show this. This is Exhibit 290, and it is not under seal. Let's take a look at record 16 and record 17. Can you see those? I'll adjust it a little bit. Can you see those on your screen, sir?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: And record 16, what does that indicate?
BRITT DOVE: Record 16 indicates that the phone recorded 49 steps on June 7, 2021, beginning time 6:02:51 p.m., ending time 6:07:33 p.m. the same day.
MR. CONRAD: All right, and record 17, what does that show?
BRITT DOVE: Record 17 indicates that the phone recorded 173 steps on June 7, 2021, beginning at 6:14:42 p.m. and ending at 6:23:46 p.m.
MR. CONRAD: And you testified yesterday about steps, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And do you recall in terms of our ability to rely on those steps what you testified to?
BRITT DOVE: Yes, sir.
MR. CONRAD: And in your opinion, what is the reliability -- what do these steps tell us? Excuse me.
BRITT DOVE: It tells that the phone recorded the steps. It's not 100 percent accurate as to that's how many steps were taken. It also will not tell where the start was, the stop was as far as distances, anything like that, but it's not 100 percent accurate. It just says the phone recorded steps; it was in movement recording steps.
MR. CONRAD: Okay, and generally for a phone to record steps, what does that tell you? How does a phone -- I mean, what kinds of motion can cause a phone to record steps?
BRITT DOVE: Possibly somebody was holding it in their hand, somebody had it in their pocket but they were moving, they were actually in motion. They were either walking, could be running. It would record the steps, but that somebody has got the phone in movement versus putting it in a cup holder in your car and driving around. It's not going to record steps that way.
MR. CONRAD: Okay. So, in your opinion, if someone puts the phone in a car seat or in a cup holder and they drive, will the phone record steps?
BRITT DOVE: No, it will not.
MR. CONRAD: All right, let's look at record 18 and 19 and adjust it a little bit here. There you go. You can make out record 18 at the top, correct?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: All right, and what does that show?
BRITT DOVE: It shows that the phone recorded 57 steps taken on June 7, 2021, at 6:42:12 p.m. beginning time, ending time 6:43:55 p.m.
MR. CONRAD: Okay. Record 19, what does that show?
BRITT DOVE: Record 19 shows that the phone recorded 283 steps beginning at June 7, 2021, at 6:52:27 p.m. and ending at 7:02:05 p.m.
MR. CONRAD: Let's look at record 20. What does that show?
BRITT DOVE: It shows the phone recorded 165 steps. Start time is June 7, 2021, at 7:03:55 p.m., with an ending time of 7:11:29 p.m.
MR. CONRAD: Okay. Let's go to record 21. What does that say?
BRITT DOVE: It shows that the phone recorded 200 steps. Start time is June 7th of 2021 at 7:15:35 p.m., ending time of 7:21:52 p.m.
MR. CONRAD: All right. Record 22, what does that say?
BRITT DOVE: Record 22 shows that the phone recorded 47 steps. Start time is June 7, 2021, at 7:28:35 p.m., ending time 7:37:11 p.m.
MR. CONRAD: All right. Record 23?
BRITT DOVE: Record 23 shows the phone recorded 270 steps. Start time is June 7, 2021, at 7:55:32 p.m. Ending time is 8:05:07 p.m.
MR. CONRAD: Okay. Record 24, and it's cut off to the next page, but read what you can, and then I'll flip it.
BRITT DOVE: The beginning of this record shows that the phone recorded 29 steps, with a start time of June 7, 2021, at 7:41:23 p.m.
MR. CONRAD: All right, let's finish record 24 there. When did those steps end?
BRITT DOVE: Those steps ended for that record on June 7th of 2021 at 7:48:41 p.m.
MR. CONRAD: All right. So this report, like the report we looked at yesterday for Maggie, it's chronologically a little bit out of order, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: But the times that you're stating, those are correct.
BRITT DOVE: Yes, sir, those are accurate.
MR. CONRAD: And just because the steps here that were recorded at 7:48 -- according to your analysis, that's when those steps occurred, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And the fact that it's listed in your report after steps that had occurred later doesn't mean those steps occurred later. Is that correct?
BRITT DOVE: Correct.
MR. CONRAD: All right. All right. Let's look at record 25. What does that say?
BRITT DOVE: Record 25 shows that the phone recorded 74 steps. Start time was June 7th of 2021 at 8:05:35 p.m., ending time of 8:09:52 p.m.
MR. CONRAD: Okay. Record 26, what does that say?
BRITT DOVE: Record 26 shows the phone recorded 283 steps, with a start time of June 7, 2021, 9:02:18 p.m., ending time 9:06:47 p.m.
MR. CONRAD: Okay. So -- and I'll hand this report back to you, but we see an hour gap, approximately an hour gap between those steps that ended at 8:09 and when the steps start to occur again at 9:02, correct?
BRITT DOVE: Correct.
MR. CONRAD: And I'll hand you your report so you can flip through it because some of the things got out of order -- just to verify -- but do you see any steps that occur on that phone between those two times, between 8:09 and 9:02?
BRITT DOVE: No, sir, I do not.
MR. CONRAD: Okay, and whose phone are we talking about again?
BRITT DOVE: This phone was Alex Murdaugh's phone.
MR. CONRAD: All right. So, in your opinion, was this phone being moved around with or walked around with during that gap in time according to the record or the analysis you've done?
BRITT DOVE: No, sir, not in my opinion based off my analysis.
MR. CONRAD: And I've previously entered State's Exhibit 289, which was the timeline for Alex's phone, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And let's talk about this timeline a little bit. So, what kind of information is found in this timeline on Alex's phone?
BRITT DOVE: On this phone, it captured things like incoming text messages to show a log entry for it. It shows there was a log entry for images, steps. It's a little bit different the way Cellebrite does steps versus AXIOM, so it's a little bit different look to it. It also has text messages on here as they came in, and a few more log entries to show that text messages and that phone calls were being made and recorded in the log.
MR. CONRAD: Do you see any orientation changes like we talked about on Maggie's phone in that report? And would it include it if there were?
BRITT DOVE: Usually you don't see it in a timeline report like this. You would find it in the device events report. We would pull it separate.
MR. CONRAD: Have you -- in your analysis, you've looked at the device events report, correct?
BRITT DOVE: Yes, sir, I have.
MR. CONRAD: All right, and during that same timeframe, do you see any orientation, movement, or anything to suggest the phone is being handled, or does that data exist? I should ask that.
BRITT DOVE: Which timeframe exactly?
MR. CONRAD: The device events, did you find data from the night of the murder on Alex's phone?
BRITT DOVE: Earlier in the evening I did, but there was a gap in time where I did not see it.
MR. CONRAD: Okay. We talked about some of these databases kind of going away after a certain period of time, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And you don't know the exact time for every single database, correct?
BRITT DOVE: Correct.
MR. CONRAD: But generally speaking most of these databases, the SQLite databases, how quickly do they turn over?
BRITT DOVE: They can go from two days to two weeks to 45 days. It just depends.
MR. CONRAD: And so when you performed your analysis on this phone, it was in September of 2021, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And so some of that information that's contained in those SQLite databases, would you expect to find it -- some of that data in September that had been originally recorded in June of 2021?
BRITT DOVE: No, sir, and if it showed anything, it wouldn't be accurate information. It would be remnants of it.
MR. CONRAD: Okay, because a lot of those databases overturn in a far shorter period of time between June and September, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: Okay, and so to sum up, Alex's phone could be -- because you didn't analyze it until September, it just simply doesn't contain as detailed data that you found on Maggie's phone, for example?
BRITT DOVE: Correct, for that timeframe of June.
MR. CONRAD: Okay, and I'm going to show you -- this is Exhibit 289 and this is under seal.
(Break in proceedings.)
MR. CONRAD: All right, and we see lines 157 and 158 in this report, correct?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And what is line 157 associated with?
BRITT DOVE: Line 157 is associated with a text message.
MR. CONRAD: All right, and that's a text message we just talked about in Alex's text message report, correct?
BRITT DOVE: Yes, sir. It shows as an incoming text message.
MR. CONRAD: All right, and I believe you just testified that that text wasn't read until the next day, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And there was a second text at -- and this is line 159, and there was a second text that you've already testified about. And what time is this text?
BRITT DOVE: It shows that it was June 7, 2021, at 8:31:47 p.m.
MR. CONRAD: And again, according to the text message report, when was this text read?
BRITT DOVE: The next day, on June 8, 2021.
MR. CONRAD: All right. You just testified about the steps, and we can get the report back to you if you need to be refreshed. What time did Alex's phone start moving after that gap between 8:05 and 9:02?
BRITT DOVE: It started moving at 9:02. There was a gap before, but it was started at 9:02 recording steps again.
MR. CONRAD: And those texts were not read at that time, correct?
BRITT DOVE: Correct.
MR. CONRAD: We looked at a couple of earlier texts in that thread, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And those texts had been read within 20 minutes, correct?
BRITT DOVE: Yes, sir, approximately.
MR. CONRAD: And in your analysis investigation, did you review other texts that might or might not be in that report that's in evidence to review Alex's habit of when he read texts?
BRITT DOVE: Yes, sir, I reviewed other texts.
MR. CONRAD: All right. From the day of the murder?
BRITT DOVE: From that day, and previous days, and the days after.
MR. CONRAD: And just in your general review, and I'm sure there's outliers, but what is Alex's general habit when he reads texts?
BRITT DOVE: Usually it could vary from -- anywhere from reading it within 5 minutes to 30 minutes, maybe 40 minutes, just depending. But it was generally within an hour's time, it appeared, that the texts were read.
MR. CONRAD: Okay, and like I said, there's probably outliers, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, but this particular thread we've been talking about with the group family thread, what was the topic they were talking about?
BRITT DOVE: It was about his father being in the hospital.
MR. CONRAD: Okay, and those texts weren't read until the next day, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right. I'm going to show you what's been marked for ID purposes as item 274. Give me a second to find it.
(Break in proceedings.)
MR. CONRAD: All right, and do you recognize that item, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: Okay, and what is that item?
BRITT DOVE: This is an Apple IPhone that we received once the analysis was done. It has the account of Paul Murdaugh.
MR. CONRAD: Okay, and when did you originally get that item, receive that item?
BRITT DOVE: I would have to refer to my notes for the actual day it was submitted.
MR. CONRAD: Do you have them with you?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right. Can you look at that, please?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right.
BRITT DOVE: It was August 13, 2021.
MR. CONRAD: Okay, and to the best of your recollection, where had the phone been previous to you?
BRITT DOVE: Previous to us it was located in Charleston County in their evidence area.
MR. CONRAD: And that was Paul McManigal, correct?
BRITT DOVE: Yes, sir. It has his sticker on there that it was in his possession.
MR. CONRAD: And to your knowledge, did he -- was he able to access Paul's phone?
BRITT DOVE: Not that I'm aware of. I believe he might have gotten just a little surface information from it, but to my knowledge he was not able to access it due to the pass code.
MR. CONRAD: The phone was locked, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And when you got it in August of '21, excuse me, was phone still locked?
BRITT DOVE: Yes, sir, it was.
MR. CONRAD: And in August of 2021, did you have any tools available at SLED that would help you unlock at that phone?
BRITT DOVE: At that time, no, sir. It would not support that model and the IOS that was running on the system.
MR. CONRAD: And these companies that develop software to access these phones, they're continuing -- that software is continuously updated, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that software isn't free, correct?
BRITT DOVE: Correct.
MR. CONRAD: And it's sort of like a game, isn't it? Apple -- these companies discover an exploit on these phones that allow them to access it, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And then Apple produces a software update that fixes that exploit, correct?
BRITT DOVE: Correct.
MR. CONRAD: And so it's kind of a continuous cycle of being able to access these phones and not, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: But in August of 2021, you did not have the ability to access Paul's phone, correct?
BRITT DOVE: No, sir, I did not.
MR. CONRAD: All right. So, let's fast forward to March of 2022. Did it come to your attention that a fellow law enforcement agency had recently acquired a tool that potentially accessed Paul's phone?
BRITT DOVE: Yes, sir. I spoke with Jon VanHouten of the United States Secret Service, and they believed they had the capabilities with the tools they had to obtain the pass code to this phone.
MR. CONRAD: And did you take that phone to Mr. VanHouten?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: All right, and approximately when was that again?
BRITT DOVE: It was in March of 2022.
MR. CONRAD: Okay. All right, and to your knowledge, was Mr. VanHouten successful in accessing Paul's phone?
BRITT DOVE: Yes, sir. I received a phone call from Mr. VanHouten stating that he was able to do an extraction on the phone, and that we were preparing it to put on an external hard drive for me to bring back and do my analysis.
MR. CONRAD: All right, and received what type of file extraction from Mr. VanHouten?
BRITT DOVE: It was a Cellebrite file extraction.
MR. CONRAD: Do you recall if it was a full file extraction, or a physical file extraction, or logical?
BRITT DOVE: It was a full file system extraction.
MR. CONRAD: And when you got that full file system extraction from Mr. VanHouten, what did you do with it?
BRITT DOVE: I processed it with Cellebrite Physical Analyzer and also verified the information with AXIOM by Magnet Forensics.
MR. CONRAD: Okay. All right, sir.
MR. CONRAD: Your Honor, at this time the State would move to enter Exhibit 274 into evidence.
MR. BARBER: Renew the previous objection.
JUDGE NEWMAN: It's admitted.
(IPHONE MARKED AS STATE'S EXHIBIT NUMBER 274 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: Okay. I'm going to show you what is premarked as Exhibit 292 and -- State's 292. You probably need to open the box. Do you recognize that, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And what is that?
BRITT DOVE: This is an external hard drive. It's a portable solid state drive that was provided to me to place the phone reports on from Paul Murdaugh's phone.
MR. CONRAD: All right, and that's -- is that -- what does it contain?
BRITT DOVE: It contains a Cellebrite report for Paul Murdaugh's phone.
MR. CONRAD: And that's a full Cellebrite report?
BRITT DOVE: Yes, sir.
MR. CONRAD: At this time, the State would move to enter Exhibit 292 into evidence.
MR. BARBER: Renew the previous objection, Your Honor.
JUDGE NEWMAN: You're entering the entire download?
MR. CONRAD: Correct, the full Cellebrite report.
JUDGE NEWMAN: And your objection is to the chain, not to the --
MR. BARBER: Correct, Your Honor.
JUDGE NEWMAN: -- what is contained on it. It's admitted.
MR. CONRAD: Thank you, Your Honor.
(EXTERNAL HARD DRIVE WITH CELLEBRITE REPORT MARKED AS STATE'S EXHIBIT NUMBER 292 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right. I'm going to hand you what is Exhibit 293. Take a look at it and let us know if you recognize it.
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And what is that?
BRITT DOVE: It appears to be my Cellebrite report that I prepared for call logs from Paul Murdaugh's phone with a date filter set for June 5th of 2021 to June 7th of 2021.
MR. CONRAD: Okay.
MR. CONRAD: At this time, the State would move to enter Exhibit 293 into evidence.
MR. BARBER: Same objection.
MR. CONRAD: And this would need to be under seal, Your Honor, due to phone numbers and private information.
MR. BARBER: No objection to sealing it.
JUDGE NEWMAN: Subject to the redaction.
(CELLEBRITE REPORT MARKED AS STATE'S EXHIBIT NUMBER 293 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: We're going to publish it so this would be under seal.
MR. CONRAD: I'm going to direct you to phone calls that occurred on the night of June 7th, and let's look at lines 5 and 6. What do you see there?
BRITT DOVE: Lines 5 and 6 show a phone call that was received June 7, 2021, at 8:32:10 p.m. It was rejected.
MR. CONRAD: All right. That call was not answered, correct?
BRITT DOVE: Correct. It shows it is incoming and rejected.
MR. CONRAD: And we see a name. What does that mean?
BRITT DOVE: Robert Boyle.
MR. CONRAD: And that's line 5, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what is line 6, the name?
BRITT DOVE: It says Lucille Boyle.
MR. CONRAD: And we encountered this with Maggie's phone. That's -- we have two different contacts because it's pulling from two different databases, correct?
BRITT DOVE: Correct.
MR. CONRAD: And those names -- that number may be labeled as a different name in two different databases, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right. Let's look above that. So, lines 3 and 4, and what do those lines indicate?
BRITT DOVE: Those lines show that the phone had an outgoing call that was placed June 7, 2021, at 8:40:20 p.m., and it was answered.
MR. CONRAD: Okay, and who is the contact name on that outgoing call?
BRITT DOVE: Rogan Gibson.
MR. CONRAD: And this is Paul's phone, correct?
BRITT DOVE: Yes, sir, it was Paul's phone.
MR. CONRAD: This was data that was stored on Paul's phone that you recovered during your investigation, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And that's an outgoing call to Rogan Gibson.
BRITT DOVE: Yes, sir.
MR. CONRAD: And how long did that call last?
BRITT DOVE: It recorded that call as 4 minutes and 14 seconds.
MR. CONRAD: Okay, and we see actually between line 3 and 4 a slight difference in that time. I believe line 4 says 4 minutes and 18 seconds. But your testimony, in looking at this data, the correct length of the call is what?
BRITT DOVE: It's 4 minutes and 14 seconds.
MR. CONRAD: All right. Let's look above that to lines 1 and 2. What do we see there?
BRITT DOVE: Lines 1 and 2 show an outgoing call on June 7, 2021, at 8:44:34 p.m.
MR. CONRAD: Okay, and what is that -- who was that call to?
BRITT DOVE: That call shows to Rogan Gibson.
MR. CONRAD: All right, and we see a source. What is that source for this call?
BRITT DOVE: It is a FaceTime call.
MR. CONRAD: All right, and how long did that call last?
BRITT DOVE: Approximately 11 seconds.
MR. CONRAD: Okay, and that was answered, correct?
BRITT DOVE: Yes, sir, it shows as answered.
MR. CONRAD: All right, and so if that call started at 8:44:34 and it lasted 11 seconds, when did that call end?
BRITT DOVE: It would have ended at 8:44:45.
MR. CONRAD: All right, and I see this is record number one, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right. So, this is the most recent call on Paul's phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Were there ever any other outgoing calls made from Paul's phone?
BRITT DOVE: No, sir, not that I found.
MR. CONRAD: Were there ever any other calls that were answered, incoming calls that were answered on Paul's phone?
BRITT DOVE: No, sir.
MR. CONRAD: I'm going to show you what's been marked as State's Exhibit 294, 2-9-4.
BRITT DOVE: Yes, sir.
MR. CONRAD: What is that?
BRITT DOVE: This is a Cellebrite report that I pulled for text messages from Paul Murdaugh's phone.
MR. CONRAD: All right.
MR. CONRAD: At this time, the State would move to enter Exhibit Number 294 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(CELLEBRITE REPORT MARKED AS STATE'S EXHIBIT NUMBER 294 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: And the State would ask it will be under seal. It will display phone numbers and to protect privacy, the State would ask that it be placed under seal.
MR. BARBER: No objection.
JUDGE NEWMAN: A redacted copy can be submitted along with the original at a later time.
MR. CONRAD: All right. Okay, and this is under seal. I'm going to publish it.
MR. CONRAD: All right, I'm going to direct your attention to -- actually we'll go back just a little. All right, let's look at line 8 on this report. Or, excuse me, that's line 3, line 3. What does this entry say?
BRITT DOVE: It's a text message that was received on this phone June 7, 2021, at 8:48:39 p.m. It shows it as an incoming text message.
MR. CONRAD: All right, and who is it from, the contact?
BRITT DOVE: It is from Meagan Kimbrell.
MR. CONRAD: All right, and what does the text message says?
BRITT DOVE: It says: Don't like watching sad movies.
MR. CONRAD: Okay, and this was an incoming message to Paul's phone, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: Does it indicate that this message was read?
BRITT DOVE: Yes, sir. It shows read June 7, 2021, at 8:48:59 p.m.
MR. CONRAD: Okay, and actually let's look at line 4, which was just below line 3, excuse me. All right. You see line 4?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: Okay, and what does this line -- this entry indicate?
BRITT DOVE: It indicates it's another text message that was received from the same sender, Meagan Kimbrell.
MR. CONRAD: What does the text message say?
BRITT DOVE: It says: No, I need something happy.
MR. CONRAD: And what is the time on this text?
BRITT DOVE: It shows the text as being received June 7, 2021, at 8:48:29 p.m.
MR. CONRAD: And what time -- what -- was this text message read by Paul's phone?
BRITT DOVE: Yes, sir. It shows it's being read June 7, 2021, at 8:48:59 p.m.
MR. CONRAD: And so lines 3 and 4 -- put them both there -- they were read at the same time, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what time was that again?
BRITT DOVE: It was 8:48:59 p.m.
MR. CONRAD: On the night of June 7th, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: All right, let's take a look at line 2. What does this record indicate, sir?
BRITT DOVE: This indicates the text message was received to this phone on June 7, 2021, at 8:49:35 p.m.
MR. CONRAD: Okay. So, this is approximately how many seconds after those texts from Meagan Kimbrell were read?
BRITT DOVE: It.
MR. CONRAD: I can flip back if you need me need to.
BRITT DOVE: Yes, sir, if you could, please.
MR. CONRAD: What time were the texts from Meagan Kimbrell read?
BRITT DOVE: At 8:48:59 p.m.
MR. CONRAD: All right, and that text from Rogan arrived at what time?
BRITT DOVE: It arrived at 8:49:35 p.m.
MR. CONRAD: I'm going to put you on the spot again. Can you give us a rough -- or how many seconds between those two texts arriving on Paul's phone?
BRITT DOVE: I would have to write that down if I tried to do the second.
MR. CONRAD: Do you have a pen or something you could write with?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right. So, the first time for Meagan was 8 -- the texts from Meagan were read at 8:48:59, and Rogan's text arrives at 8:49:35.
BRITT DOVE: Approximately 36 seconds.
MR. CONRAD: Okay. Was this text from Rogan ever read on Paul's phone?
BRITT DOVE: No, sir. It shows the status as unread.
MR. CONRAD: Ever.
BRITT DOVE: Ever.
MR. CONRAD: So, when you got this phone download from VanHouten, that indicated that this text from Rogan was never read, correct?
BRITT DOVE: Correct.
MR. CONRAD: 8:49:35.
BRITT DOVE: Correct.
MR. CONRAD: 36 seconds earlier there were two texts from Meagan Kimbrell that were read, correct?
BRITT DOVE: Correct.
MR. CONRAD: And we see one final text above that in line 1. What does line 1 indicate, sir?
BRITT DOVE: Line 1 shows that it was an incoming text message from Rogan Gibson on 6/7/2021 at 9:58:35 p.m.
MR. CONRAD: And what does that text say?
BRITT DOVE: Yo. Y-o.
MR. CONRAD: Was that text ever read?
BRITT DOVE: No, sir, the status is unread.
MR. CONRAD: All right, and I'm going to dig back into your memory from yesterday, from Maggie's phone. Do you recall a text on Maggie's phone that was read at 8:49:27?
BRITT DOVE: Yes, sir.
MR. CONRAD: And I believe that was a text from Lynn G in the group text thread, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right. Why don't you write that number down, 8:49:27. All right, and that was a text from Lynn G to the group thread about Randolph's health that was read at 8:49:27, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right, and then we have here line 2, a text from Rogan that was at 8:49:35, correct?
BRITT DOVE: Correct.
MR. CONRAD: How much time separates those two texts?
BRITT DOVE: Approximately 8 seconds.
MR. CONRAD: And that text from Rogan was never read, correct?
BRITT DOVE: Correct.
MR. CONRAD: All right. In your investigation, you look at the status of the phone of when certain things occurred, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: Things like battery status, correct?
BRITT DOVE: Correct.
MR. CONRAD: And at the time of these texts, what was Rogan's battery status? Do you recall?
BRITT DOVE: Rogan's battery status or Paul's?
MR. CONRAD: Or excuse me, Paul's. I'm sorry, Paul's.
BRITT DOVE: Paul's battery state at that point was approximately two percent.
MR. CONRAD: Okay. So, that's a low battery state, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what was it when those texts from Meagan arrived on his phone?
BRITT DOVE: It would have been between two and three percent.
MR. CONRAD: Okay, and in your opinion, is there any way -- reason that low battery state would have permitted Paul to read the text from Meagan but not from Rogan 36 seconds later?
BRITT DOVE: No, sir.
MR. CONRAD: And if he had read that text at 8:49:35, in your opinion would the phone have logged that and recorded that event?
BRITT DOVE: Yes, sir. It should have recorded it as a read status.
MR. CONRAD: And that battery would not have prevented that phone from recording that text being read, correct?
BRITT DOVE: Correct.
MR. CONRAD: And in your investigation -- we know you just testified Paul's phone was at two percent at approximately 8:49, correct?
BRITT DOVE: Correct.
MR. CONRAD: Did your investigation reveal in that phone log when that battery finally died on Paul's phone?
BRITT DOVE: Yes, sir, at approximately 10:34 p.m. on June 7th.
MR. CONRAD: Which is, roughly speaking, about how long after those texts arrived on Paul's phone?
BRITT DOVE: Approximately 39 minutes for the last one.
MR. CONRAD: Okay. All right, and I'm not even sure this needs to be an expert opinion, but if a phone that is at two percent is used heavily, how long approximately would you expect that phone to last before it dies?
BRITT DOVE: If it's being heavily used, text messaging and looking at videos, things of that nature that are going to put more strain on the battery, I would expect it to go to the point of being dead. I would imagine in just kind of a ballpark, because I haven't done testing on this, but I would say 10 to 15 minutes max.
MR. CONRAD: So, a matter of minutes, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, but that phone sits there for what did you say, almost 39 minutes?
BRITT DOVE: Yes, sir.
MR. CONRAD: Actually, I'm sorry, let's -- let's do that math again. If Paul's battery state at 8:49 is two percent and it dies at 10:34, again, how many minutes is that approximately?
BRITT DOVE: 36. I'm sorry, I miss subtracted.
MR. CONRAD: And I think we're both suffering from some math phobia here, Lieutenant Dove. We're going to do that one more time, and we can write this down if we need to, you know. Us lawyers, we don't do math, so 8:49 the battery is at two percent, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And the phone dies at what time?
BRITT DOVE: From the last text message or from --
MR. CONRAD: What time does Paul's -- just write down the time. What time does Paul's die?
BRITT DOVE: At 10:34 p.m.
MR. CONRAD: All right, and how much time is between approximately?
BRITT DOVE: From the last text messaging received from Rogan --
MR. CONRAD: From 8:49 until 10:34.
BRITT DOVE: I'm sorry, I was going off the last time a message was received to the phone.
MR. CONRAD: That's probably my fault.
BRITT DOVE: About an hour and 35 minutes.
MR. CONRAD: Okay. All right. Okay, and I'm going to show you what's been marked as Exhibit 295.
BRITT DOVE: Okay.
MR. CONRAD: Do you recognize that, sir?
BRITT DOVE: Yes, sir. This is a copy of the Cellebrite report I prepared for a timeline of Paul Murdaugh's phone.
MR. CONRAD: And I notice this is quite a bit thicker than some of the other reports that we've been through, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: Why would that be?
BRITT DOVE: That one also contains location information that was obtained from the cache SQLite database.
MR. CONRAD: So, there's a lot more data points on Alex's phone, correct?
BRITT DOVE: There's a lot more on Paul's phone on that timeline.
MR. CONRAD: Or, excuse me, on Paul's phone. Excuse me.
MR. CONRAD: At this time, the State would move to enter Exhibit 295 into evidence.
MR. BARBER: Renew the previous objection.
JUDGE NEWMAN: It's admitted.
(TIMELINE REPORT MARKED AS STATE'S EXHIBIT NUMBER 295 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: And just -- what timeframe, again, does that report span?
BRITT DOVE: The timeframe of this report, I began it at 6:00 p.m. on June 7, 2021, and it ran through midnight on June 7, 2021.
MR. CONRAD: And just roughly speaking, if you were to print even two or three days' worth of this information on Paul's phone, how many pages would you roughly expect that report to be?
BRITT DOVE: Several thousands of pages.
MR. CONRAD: All right, and so this is just a couple of hours, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right.
MR. CONRAD: And, Your Honor, there are some phone numbers contained on this report so the State would move that it be sealed for privacy reasons.
MR. BARBER: No objection.
JUDGE NEWMAN: Okay.
MR. CONRAD: And I'm just going to pull some examples here. And I'm looking at lines 325 through 329. What is the date range that you see there?
BRITT DOVE: Beginning with 325, it's June 7, 2021, 6:44:47 p.m. Going to line 329 is going to be June 7, 2021, at 6:46 p.m.
MR. CONRAD: So, that's approximately 2 minutes' worth of log entries, correct?
BRITT DOVE: Yes, sir. A little bit less than 2 minutes.
MR. CONRAD: Lines 325 and 326 and 327, what kind of entries are those?
BRITT DOVE: 325, 326, and 327 are location data entries into the cache SQLite database.
MR. CONRAD: Okay, and we see some numbers at the top there. I see a 32.83, and then some other numbers and a minus 81.05 and some other numbers. What do those numbers indicate?
BRITT DOVE: They're latitude and longitude numbers.
MR. CONRAD: All right. Now -- and we see three entries within almost seconds, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: So, what does that tell you generally speaking about Paul's phone and his settings on whether they -- his phone will record location data frequently or not?
BRITT DOVE: It's recording it much more frequently, and every few seconds it's grabbing this information to this database.
MR. CONRAD: Okay, and so is Paul's phone as locked down as Maggie's in comparison -- in regards to location?
BRITT DOVE: It appears it is collecting more data as far as location information than Maggie's phone did.
MR. CONRAD: All right, and I'm going to direct your attention to line 328 there. And what is that entry?
BRITT DOVE: This is an entry from an application usage that shows it was in there, and I believe this application is related to Snapchat.
MR. CONRAD: And what does it actually say there?
BRITT DOVE: It actually says calm.toyopagroup.picaboo.
MR. CONRAD: Dot picaboo?
BRITT DOVE: Yes.
MR. CONRAD: And you researched -- and you researched what that means?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: And you've discovered what?
BRITT DOVE: That it's related to Snapchat.
MR. CONRAD: All right. Snapchat usage?
BRITT DOVE: Yes, sir.
JUDGE NEWMAN: Ladies and gentlemen, we'll take a break now. If you'll go to the jury room for about 10 minutes or so.
(The jury left the courtroom.)
(A break was taken.)
JUDGE NEWMAN: All right. Bring the jury.
(The jury returned to the courtroom.)
COURT BAILIFF: The jury is present, sir.
JUDGE NEWMAN: You may proceed.
MR. CONRAD: Thank you, Your Honor.
BY MR. CONRAD:
MR. CONRAD: Lieutenant Dove, I'm going to circle back to what has already been admitted State's 294, and this is the text message report that you produced, sir?
BRITT DOVE: Yes, sir.
MR. CONRAD: And this is under seal. We're just going to flesh out a little bit that -- that text conversation with Meagan Kimbrell just for a little more context. Lines 10 and 11, can you tell us what's indicated on those two records?
BRITT DOVE: Yes, sir. On line 10 it shows that it was a --
MR. CONRAD: Actually, I'm sorry, let me stop you. Let's read line 11 just to keep it chronologically in order. Go ahead, line 11.
BRITT DOVE: Line 11 shows it was an incoming text message on June 7, 2021, at 8:29:06 p.m, and the message says: You didn't send me any movie recommendations.
MR. CONRAD: And the contact associated with that incoming text?
BRITT DOVE: It's from Meagan Kimbrell.
MR. CONRAD: All right, and when was that text read?
BRITT DOVE: It shows it as being read on June 7, 2021, at 8:29:17 p.m.
MR. CONRAD: Okay. Within about 11 seconds of it arriving on Paul's phone?
BRITT DOVE: Yes, sir.
MR. CONRAD: And let's look at the line above that, line 10?
BRITT DOVE: Line 10 shows it as an outgoing text message from Paul Murdaugh to Meagan Kimbrell that -- on June 7, 2021, at 8:29:36.
MR. CONRAD: And what does that text say?
BRITT DOVE: That -- it says: Haha, I didn't have a good one.
MR. CONRAD: And again, that's to Meagan Kimbrell from Paul, correct? Paul's phone.
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: All right, let's look at lines 9 and 8. All right, what does line 8 indicate? Excuse me, I'm sorry, line 9.
BRITT DOVE: Line 9 indicates that it was a text message sent from Paul Murdaugh's phone to Meagan Kimbrell at 8:29:48 p.m., and it says: Wills May.
MR. CONRAD: Wills what? I'm sorry.
BRITT DOVE: Wills Might.
MR. CONRAD: And that was an outgoing text, right?
BRITT DOVE: Yes, sir.
MR. CONRAD: And in line 8, what does that indicate?
BRITT DOVE: Line 8 shows it as an incoming text message from Meagan Kimbrell on June 7, 2021, at 8:30:10 p.m., and it says: OMG.
MR. CONRAD: All right, and that was an incoming text from Meagan Kimbrell?
BRITT DOVE: Yes.
MR. CONRAD: And when was it read on Paul's phone?
BRITT DOVE: It shows it as being read June 7, 2021, at 8:30:13 p.m.
MR. CONRAD: All right, and just so the jury understands the context, those were text messages in the same conversations that they heard about from Meagan Kimbrell, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And just to refresh so that circle is complete, let's look at lines 5 and 6 again. And line 6, is that a text that was sent, or outgoing, to Meagan Kimbrell?
BRITT DOVE: It shows it as an outgoing or sent text message.
MR. CONRAD: And what does that message say again?
BRITT DOVE: It says: Haha, kidding.
MR. CONRAD: All right, and then line 5, what does that indicate?
BRITT DOVE: Line 5 shows it as an outgoing, or sent text message, with a body -- or the text message saying: Star was born is the move.
MR. CONRAD: Okay, and that was at 8:48:05?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that was an outgoing text from Paul, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And then we've talked about these texts, but real quickly overview, at line 4 at 8:49:29, is that an incoming text?
BRITT DOVE: At 8:48:29, it's an incoming text message.
MR. CONRAD: From who?
BRITT DOVE: From Meagan Kimbrell.
MR. CONRAD: All right, and that says again?
BRITT DOVE: No, I need something happy.
MR. CONRAD: All right, and then line 3, is that an outgoing or incoming text?
BRITT DOVE: That is an incoming text message.
MR. CONRAD: From who?
BRITT DOVE: It's from Meagan Kimbrell.
MR. CONRAD: And what does that say again?
BRITT DOVE: It says: Don't like watching sad movies.
MR. CONRAD: All right, and so those are both incoming texts. And when were those texts read again?
BRITT DOVE: They were read on June 7, 2021, at 8:48:59 p.m.
MR. CONRAD: Okay, and so going back to line 5 just so it's clear in your investigation, is this the last outgoing text from Paul's phone?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that's at 8:48:05, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right. A moment ago we were discussing State's Exhibit 295, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And this is that timeline report from Paul's phone, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: That thick -- how many hours again does that cover in Paul's timeline for the night of the murder?
BRITT DOVE: I set the timeline parameters beginning at 6:00 p.m. on June 7, 2021, to end at midnight on June 7, 2021, but the timeline stopped short of that.
MR. CONRAD: Okay. What time does the timeline stop?
BRITT DOVE: The timeline stops at 10:34:23 p.m.
MR. CONRAD: Okay. Okay, and I think you previously testified about that time. What is that 10:34 p.m. indicate to you what happened at that time?
BRITT DOVE: That there was a power event, the phone had gone dead and turned off.
MR. CONRAD: And I'm going to show that. That's line 901. And that's the final log entry from June 7th of 2021, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And you testified -- what is your interpretation of that log entry?
BRITT DOVE: When I looked at that, it was a power event where the phone had gone dead or turned off because the battery life ran out.
MR. CONRAD: And can you tell us with -- can you tell for certain whether the phone was simply turned off or the battery died?
BRITT DOVE: It appears from what I looked at that the battery died.
MR. CONRAD: And that's line what again?
BRITT DOVE: That is line 901.
MR. CONRAD: All right, and so that means in this particular report there's over 900 log entries, correct?
BRITT DOVE: Correct, in just this report, yes, sir.
MR. CONRAD: Okay, and we're not going to go through it line by line, but I'm going to hand this back to you and I'm going to ask you some questions. And we previously discussed a lot of what is contained in this report is location data. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Now, did you personally take all of those lat/longs and plot them somewhere?
BRITT DOVE: No, sir, I did not.
MR. CONRAD: Okay, but you provided that location data to other law enforcement agents or agencies, correct?
BRITT DOVE: Correct.
MR. CONRAD: And specifically, to your knowledge, has it been provided to the FBI?
BRITT DOVE: Yes, sir. It was provided to the FBI to do some mapping with the location data.
MR. CONRAD: Okay, and do you recall who in the FBI did that?
BRITT DOVE: I believe it was Agent Wilde.
MR. CONRAD: Okay. Well, let's make some general observation on what you see in that timeline. We see a lot of location data. Take a few minutes to look through that timeline, just in an overall picture. What is that phone generally used for? What is being done on that phone in a general impression?
BRITT DOVE: It appears that on this phone, based off this timeline, that there were calls being made, text messaging being done, Snapchat being utilized, social media type things with Snapchat, and the text messaging, and calls.
MR. CONRAD: And when you look at that usage, would you say it's sporadic or almost continuous?
BRITT DOVE: It's a lot of continuous usage. Like I said, I pulled it from 6:00 p.m., and it ends at 10:24. So, in a matter of about 4 and a half hours, it's over 900 entries on here.
MR. CONRAD: Okay. I'm going to direct you to time about 8:44, and you can take a moment to find it, 8:44 p.m., and I want to see if you can find -- I believe there's an entry for the camera. And it's a little after 8:44 and some change.
BRITT DOVE: Yes, sir, I see it.
MR. CONRAD: What is the exact time that you see?
BRITT DOVE: It says 8:44:49 p.m., on June 7, 2021.
MR. CONRAD: Okay, and actually -- so, what does that camera -- we'll show this in a moment. What does that entry indicate to you?
BRITT DOVE: That the camera was being utilized. It was an application usage so the camera was being utilized, or beginning to be utilized at that point.
MR. CONRAD: The camera was turned on?
BRITT DOVE: Yes.
MR. CONRAD: Okay, and I want you to look at the next page, or maybe the page after, and see if you can find a corresponding log entry that would show that the camera was turned off.
BRITT DOVE: Yes. The camera shows it was turned off at 8:45:47 p.m., on June 7, 2021.
MR. CONRAD: Okay. All right, and let's show this to the jury real quick. And I believe what you were referencing -- can you see that, sir?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that is line 820. Do you see that?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And we see a 8:44:49, and that's a start time, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And we see the camera turned on, correct?
BRITT DOVE: It shows the camera, and the application usage log shows camera, yes, sir.
MR. CONRAD: Okay, and then below that at line 822, we see some location data. Is that correct?
BRITT DOVE: Yes, sir, that's correct.
MR. CONRAD: All right, and I know you didn't plot every point on this report. Did you plot that particular point?
BRITT DOVE: Yes, sir.
MR. CONRAD: And where did that -- where was that location?
BRITT DOVE: It was located near a red roofed building on the property on Moselle Road.
MR. CONRAD: Okay, and why don't you write that time down again? It was -- I'm sorry, it was at line 820. Just write that time, 8:44:49. Have you got it?
BRITT DOVE: Yes, sir.
MR. CONRAD: Okay, and let's look at line 828. What do you see there?
BRITT DOVE: That shows the end time for the camera at 8:45:47 p.m.
MR. CONRAD: Okay. Write that time down. I think you know what's coming.
BRITT DOVE: Yes, sir.
MR. CONRAD: How long was that camera on?
BRITT DOVE: That camera went -- one second, let me --
MR. CONRAD: Take your time.
BRITT DOVE: It went for less than a minute.
MR. CONRAD: Okay.
BRITT DOVE: About 50 seconds roughly.
MR. CONRAD: Okay, and I'm going to hand this report back to you, and I'm just going to have you, again, look through it and see if you can form an opinion. Starting at -- remember the text series we just went through with Meagan Kimbrell and the text from Rogan at 8:49:35?
BRITT DOVE: Yes, sir.
MR. CONRAD: Why don't you flip in that report to basically at 8:49.
BRITT DOVE: All right. I have it.
MR. CONRAD: All right. So, starting with the outgoing text to Meagan -- or, excuse me, with the read text to Meagan, which were read at, I believe, 8:48:59, why don't you go ahead and review the rest of that report? And I want you to tell this jury whether you see anything in that report that would indicate to you that that phone was being actively used by a human being.
BRITT DOVE: No, sir, I do not.
MR. CONRAD: Okay. All right, and you previously testified that Paul's battery was at two percent at approximately 8:49 p.m., correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: But you testified that the battery actually didn't die until 10:34, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: Almost -- well, a little over an hour and a half later, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And would that indicate to you, in your opinion, that that phone did anything except for some potential minor movements than just sit in a single location that entire time?
BRITT DOVE: Correct. I see no other movement on there, recorded steps or applications being used such as social media.
MR. CONRAD: Which brings me to this. I'm going to show you State's Exhibit 296 and see if you recognize that, sir.
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: Okay. All right, and what is that?
BRITT DOVE: This is an AXIOM report that I prepared for Magnet Forensics recording the health database for Paul's phone.
MR. CONRAD: And at this time, the State would move to enter Exhibit 296.
MR. BARBER: With previous objection, Your Honor.
MR. CONRAD: This will not be under seal, Your Honor.
JUDGE NEWMAN: Can I see it?
MR. CONRAD: Yes, sir.
(Break in proceedings.)
JUDGE NEWMAN: It's admitted over objection.
(AXIOM REPORT MARKED AS STATE'S EXHIBIT NUMBER 296 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, let's look at a few of these. I'm going to show you a record, 43 and 44. Do we see those, sir?
BRITT DOVE: Yes, sir, I can.
MR. CONRAD: All right, and what do those two records indicate? And let's try to keep it chronological, so, start with 43.
BRITT DOVE: 43 shows that the phone recorded 105 steps. Starting time was June 7, 2021, at 6:54:21 p.m. Ending time is 7:03:49 p.m.
MR. CONRAD: All right, and record 44, what does that indicate?
BRITT DOVE: Record 44 shows that the phone recorded 208 steps, start time of June 7, 2021, at 7:14:13 p.m., ending at 7:22:19 p.m.
MR. CONRAD: All right. Record 45, what does that indicate?
BRITT DOVE: Record 45 shows steps recorded on the phone of 139 starting June 7, 2021, at 7:25:03 p.m., and ending at 7:34:47 p.m.
MR. CONRAD: Record 46, what does that indicate?
BRITT DOVE: Record 46 shows the phone recorded steps of 171 beginning June 7, 2021, at 7:35:10 p.m. and ending at 7:41:43 p.m.
MR. CONRAD: All right. Record 47, what does that indicate?
BRITT DOVE: Record 47 shows steps recorded on the phone of 89 beginning June 7, 2021, at 7:45 27:00 p.m. and ending at 7:55:11 p.m.
MR. CONRAD: Okay, and you see record 48, what does that say?
BRITT DOVE: Yes, sir. It says steps were recorded on the phone of 140. Start time is June 7, 2021, at 8:15:55 p.m. and ending at 8:21:45 p.m.
MR. CONRAD: Okay, and record 49, and what does that state?
BRITT DOVE: Record 49 indicates that 283 steps were recorded by the phone beginning June 7, 2021, at 8:32:25 p.m. and ending at 8:42:11 p.m.
MR. CONRAD: Okay. All right, and there's a couple of entries after this, but chronologically I'm going to have you review this. They occurred prior to 8:42, correct?
BRITT DOVE: Yes, sir, they do.
MR. CONRAD: All right, and we'll show those to the jury real quick. All right. Record 50 and 51, what times did those steps occur at?
BRITT DOVE: Record 50, the time started was June 7, 2021, at 8:05:46 p.m. and ending at 8:15:24 p.m. Record 51 shows starting time of June 7, 2021, at 7:55:44 p.m. and ending at 8:05:28 p.m.
MR. CONRAD: And so chronologically speaking, those two events occurred prior to record 49, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: We'll go back to record 49. I'm going to hand the report back to you, and as you testify, those steps ended at 8:42:11 p.m., correct? Record 49.
BRITT DOVE: Yes, sir, correct, they ended at 8:42:11 p.m.
MR. CONRAD: All right, and I'll give you a moment to review your report if you would like. Did any other steps -- were any other steps recorded on Paul's phone after 8:42:11 p.m.?
BRITT DOVE: No, sir. I do not see any that were out of order.
MR. CONRAD: Okay. So after 8:42:11 p.m., did Paul's phone move into any significant degree, in your opinion, or was it walked anywhere to any significant degree, in your opinion?
BRITT DOVE: In my opinion, I did not see any steps recorded on the phone. So, it was not in motion with somebody moving it or holding it and moving.
MR. CONRAD: Now, you testified that the steps aren't necessarily 100 percent accurate, correct?
BRITT DOVE: Correct.
MR. CONRAD: So, is it possible the phone moved a short distance during that time, correct?
BRITT DOVE: Correct.
MR. CONRAD: And a short -- a few steps may not -- may or may not have been recorded if the phone had been removed after 8:42:11, correct?
BRITT DOVE: Correct, it's possible.
MR. CONRAD: But in your opinion, was that phone walked anywhere any significant amount of distance?
BRITT DOVE: No, sir. I do not see any recordings of that.
MR. CONRAD: And it's tough to quantify significant, isn't it?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: All right, and I'm not going to ask you to give us a precise number because -- do you know a precise number?
BRITT DOVE: No, sir, I do not.
MR. CONRAD: All right, but in your opinion, can that move -- can that phone move a short distance and not record steps?
BRITT DOVE: Yes, sir. Since it's not 100 percent accurate, you may have one or two steps that don't get recorded. Usually if it's a large amount of steps, if you're 15, 20, 30 steps, it's going to record that.
MR. CONRAD: Okay. All right. We're about -- we're getting to the end here, Lieutenant Dove. One quick thing I want to go back and cover. Let's talk about Maggie's phone real quick. And you previously testified that you saw that orientation change on Maggie's phone between 9:06 -- it starts at 9:016:12 p.m., correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And ends at 9:06:20 p.m., correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and that indicated, you previously testified, that someone had that phone in their hands during that time, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: However, you also testified that there is one other possibility that could explain how an orientation change could record on a phone, correct?
BRITT DOVE: Yes, sir. If it fell, like, down steps or something like that and was on.
MR. CONRAD: You also, I believe, testified that if a phone tumbles end over end in some way, that could potentially record orientation change, correct?
BRITT DOVE: Yes, sir. If the phone is on --
MR. BARBER: Objection.
JUDGE NEWMAN: Sir?
MR. BARBER: Leading.
JUDGE NEWMAN: Don't lead the witness.
MR. CONRAD: Yes, sir.
MR. CONRAD: If a phone falls and tumbles end over end, could it potentially record an orientation change?
BRITT DOVE: If the phone is on and unlocked, it can record the orientation change.
MR. CONRAD: All right. If the phone is thrown and tumbles end over end, could it record an orientation change?
BRITT DOVE: It would be hard to do if it's off. If the screen display's off and it's not unlocked, it would be hard to record that.
MR. CONRAD: In theory it is possible.
BRITT DOVE: In theory I'm sure it's possible, yes, sir.
MR. CONRAD: And in your opinion is that likely?
BRITT DOVE: Usually when phones -- if you're holding a phone, you take your phone, unless you move it, if you take your phone and it's sideways and you lay it down on the table, it's not going to record an orientation change. If it's in portrait mode and you set it straight and don't turn it over the end, it's not going to record the change, but it is possible.
MR. CONRAD: In your opinion, if someone throws a phone with no other manipulation, could it be thrown a short distance without recording an orientation change?
BRITT DOVE: Yes.
MR. CONRAD: All right. Now, one thing we haven't talked about with Maggie and Alex's phone is one other review you've done to these phones is those phones have a lot of photographs and videos on them, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And you've reviewed -- I don't know if you've reviewed them all, but have you reviewed a substantial portion of them?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and did you find anything on Maggie or Alex's phone that was relevant to the investigation on -- at least on June 7th of 2021?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: On Maggie or Alex's phone?
BRITT DOVE: I'm sorry, no, not on Maggie or Alex's phone.
MR. CONRAD: At least in relation to the events of that night, was there anything recorded on Maggie or Alex's phone that was relevant that you found?
BRITT DOVE: As far as video recordings or photograph recordings, no.
MR. CONRAD: All right. Paul's phone, did you conduct a similar review?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: And did you find anything that you considered relevant to what occurred on the night of June 7th at Moselle?
BRITT DOVE: Yes, sir, I did.
MR. CONRAD: Okay, and, in fact, we've already referenced it, haven't we?
BRITT DOVE: Yes, sir.
MR. CONRAD: When we looked at Paul's timeline, we saw an entry of Paul's camera coming on, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And I think you wrote the time down, but if you can't find it, we can get the report out again, but what time did that camera come on?
BRITT DOVE: At 8:44:49.
MR. CONRAD: Okay, and how long was that video again?
BRITT DOVE: It was roughly 50 seconds.
MR. CONRAD: And when did that video end?
BRITT DOVE: At 8:45:47.
MR. CONRAD: And you're certain about that?
BRITT DOVE: Yes, sir.
MR. CONRAD: Why are you certain about that?
BRITT DOVE: Because I reviewed the video for looking at the length of the video and comparing it to the length of the camera time that was on. Also, too, there was data recorded in the video because it was taken with a phone. It had GPS coordinates along with a description of the phone that took it.
MR. CONRAD: Okay, and you're telling this jury today that you're certain that that is when that video was recorded on Paul's phone.
BRITT DOVE: Yes, sir.
MR. CONRAD: And as we referenced when we were looking at that timeline, there's location data associated with that video, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: And where did you plot that location at?
BRITT DOVE: It plotted to Moselle Road to near a building that had a red roof on it.
MR. CONRAD: Okay. I'm going to show you what's been marked as State's Exhibit 297. Do you recognize that, sir?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: And what is that?
BRITT DOVE: It is a CD that contains a video on it. It says kennel video. It has State's 297 on there, along with my initials and the date of 1/30/23.
MR. CONRAD: And have you reviewed the contents of that CD?
BRITT DOVE: Yes, sir, I have.
MR. CONRAD: And what is the contents of that CD?
BRITT DOVE: It is a video I found on Paul Murdaugh's phone. The video looks like inside maybe a kenneled area with a fence around it, and a dog, I believe to be a lab, where he's trying to take a view of the tail of the dog.
MR. CONRAD: Okay. All right, and that's what you see in that video.
BRITT DOVE: Yes, sir.
MR. CONRAD: What do you hear in the video?
BRITT DOVE: You hear three different voices in the video. You can tell -- because they're so different, you can tell that they're different voices.
MR. CONRAD: All right. Now, are any of those voices known personally to you?
BRITT DOVE: No, sir, they are not.
MR. CONRAD: Okay.
MR. CONRAD: At this time, the State would move to enter Exhibit 297 into evidence.
MR. BARBER: The previous objection, Your Honor.
JUDGE NEWMAN: It's admitted over objection.
(DVD MARKED AS STATE'S EXHIBIT NUMBER 297 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, and at this time, the State is going to publish that video. It is not under seal.
(The video was played. Audio not transcribed.)
MR. CONRAD: What time is that video recording again, Lieutenant Dove?
BRITT DOVE: The camera begins at 8:44:49 p.m.
MR. CONRAD: And ends when?
BRITT DOVE: At 8:45:47 p.m.
MR. CONRAD: Nothing further from the State.
JUDGE NEWMAN: Cross-examination.
CROSS-EXAMINATION
BY MR. BARBER:
MR. BARBER: Good morning, Lieutenant Dove. My name is Phillip Barber. I represent Mr. Murdaugh.
BRITT DOVE: Good morning.
MR. BARBER: I'm going to -- I would like to get to a timeline as soon as possible, but first I want to go over just a few things we've been talking about. We talked about reading text messages, when they're sent and when they're read.
BRITT DOVE: Yes, sir.
MR. BARBER: Is it possible to see the contents of a text message without it being marked read?
BRITT DOVE: Yes, sir, it is.
MR. BARBER: And how would that be?
BRITT DOVE: If you have a notification on your phone on the locked screen, it would show a text message. Depending on how long the text message is, you could see the text message and read most of the content without actually opening it and reading the message.
MR. BARBER: And we talked about the battery on Paul's phone, and it was down to two percent when this last text message was marked as read. Is that correct?
BRITT DOVE: It was in that timeframe, yes, sir.
MR. BARBER: And is it reasonable to that someone whose battery it down to two percent might curtail their use of the phone?
BRITT DOVE: It is possible, yes, sir.
MR. BARBER: Okay. We've talked a lot about orientation changes, and I think there was some discussion right before we saw that video about orientation changes, and I think we should go to into some detail about exactly what that means. So, I'm going to show you what's been marked as Defendant's Exhibit 38. And do you recognize that, sir?
BRITT DOVE: Yes, sir, I do. It appears to be part of the KnowledgeC database with some tables changed up because it's so large to make it more readable.
MR. BARBER: A KnowledgeC database for whose phone?
BRITT DOVE: At the top it says Maggie Murdaugh's phone.
MR. BARBER: And you talked about the KnowledgeC database a little bit yesterday, but maybe just to refresh, what is that?
BRITT DOVE: KnowledgeC database is a rather good size database; it records a lot of information inside your phone. It can be orientation changes. It can be whether a phone is plugged into a wall, to a car. It can record such things as applications if they were launched sometimes in there. Just -- it's a variety of things. It can record battery -- it's part of the power log, too, where it will record the battery usage as far as the percents.
MR. BARBER: Your Honor, at this time defendant would offer Exhibit 38 into evidence.
JUDGE NEWMAN: What says the State?
MR. CONRAD: No objection.
JUDGE NEWMAN: It's admitted without objection.
(DATABASE REPORT MARKED AS DEFENDANT'S EXHIBIT NUMBER 38 WAS RECEIVED INTO EVIDENCE.)
MR. BARBER: Can we please publish to the jury? And can we go to the last page?
MR. BARBER: And, sir, if you would please turn to the last page.
BRITT DOVE: Yes, sir.
MR. BARBER: Is this -- this is not a list of everything in KnowledgeC, correct?
BRITT DOVE: Correct.
MR. BARBER: This is just showing orientation changes.
BRITT DOVE: Correct.
MR. BARBER: And is this showing all of the orientation changes in this database in Maggie Murdaugh's phone?
BRITT DOVE: For the timeframe that it's set up as far as June 3, 2021. It ends on June 7, 2021.
MR. BARBER: Do you know if Maggie Murdaugh's phone had any orientation changes in the KnowledgeC database before June 3rd?
BRITT DOVE: Nothing that I remember seeing.
MR. BARBER: If we turn to the very last orientation change, do you see that as date recorded 9:06 and 22 seconds?
BRITT DOVE: Yes, sir, I do.
MR. BARBER: And that's on June 7th.
BRITT DOVE: Yes, sir, it is.
MR. BARBER: Is that the last orientation change before the phone was recovered by law enforcement the next day?
BRITT DOVE: According to what I looked at, that's the last one I saw.
MR. BARBER: And where was the phone recovered?
BRITT DOVE: I'm not exactly sure. I wasn't at the scene. I know it was not recovered near the kennel area but exactly where, I wasn't there so I'm not sure.
MR. BARBER: I mean, do you -- are you aware that it was recovered from the side of the road into the woods about 15 feet?
BRITT DOVE: I've heard that, but like I said, I was not on scene so I can't say 100 percent I was there to see it.
MR. BARBER: What I want to ask about here is we had three different dates and times for this one orientation change, and I just want to understand what each one means. So, the first one date recorded, which is at 9:06:22, what does that mean?
BRITT DOVE: That's when it recorded the orientation change.
MR. BARBER: So, would that mean that that's when this line was written in the database?
BRITT DOVE: Yes, sir.
MR. BARBER: So the start time orientation change, what does that mean?
BRITT DOVE: It's when it started to record that the orientation change was happening.
MR. BARBER: Okay, and then I see the end time would be when it ended 8 seconds later, correct?
BRITT DOVE: Yes, sir.
MR. BARBER: And what does that mean for an orientation change to take 8 seconds?
BRITT DOVE: That it was in that position.
MR. BARBER: So, is it taking 8 seconds to go from portrait to landscape?
BRITT DOVE: No, sir. It was recording that it was in that. It did not show that it changed. If it's in portrait and it didn't show that it changed from portrait to landscape or from landscape to portrait, it shows it was in that position for that period of time.
MR. BARBER: Okay. So -- and then over here, this number, there's numbers that are one and one. Zero would be landscape and one would be portrait, correct?
BRITT DOVE: Yes, sir, correct.
MR. BARBER: Okay. So, we have here, this is the last orientation change before it's recovered, and we have a start time and an end time of 12 seconds to 20 seconds. Is that correct?
BRITT DOVE: Yes, sir.
MR. BARBER: And do you recall that there was an incoming phone call in that time period?
BRITT DOVE: Yes, sir. There were incoming phone calls around the 9:04, 9:05, and I think at 9:08 also, or a text message around then.
MR. BARBER: Do you recall that there was a phone call between 9:06 and 12 seconds, and 9:06 and 20 seconds?
BRITT DOVE: Yes, sir, I believe there was.
MR. BARBER: And who was that call from?
BRITT DOVE: It was from Alex Murdaugh.
MR. BARBER: So, during the period of this orientation change, there's an incoming call from Alex Murdaugh.
BRITT DOVE: Yes, sir.
MR. BARBER: And so during this period the screen is on, correct?
BRITT DOVE: The screen would light up once the call is made, yes, sir.
MR. BARBER: And it's ringing, correct?
BRITT DOVE: I'm assuming it would be, yes, sir.
MR. BARBER: Okay. We'll come back to that when we try to flesh out a little bit of the timeline. The next thing I wanted to ask you about, I'll show you what's been marked as Defendant's Exhibit 41. Do you recognize that, sir?
BRITT DOVE: Yes, sir. This is another table from the KnowledgeC database.
MR. BARBER: It's -- actually isn't it the same table, sir?
BRITT DOVE: Well, it's part of the same table. It's actually -- the other one contained the orientation. This one contains apps.
MR. BARBER: And this one contains -- well, let me ask this. When you -- under screen name, do you see Siri UI?
BRITT DOVE: Yes, sir, I do.
MR. BARBER: And do you understand what that is?
BRITT DOVE: Yes, sir.
MR. BARBER: Okay.
MR. BARBER: At this time, Mr. Murdaugh would offer Defendant's Exhibit 41 into evidence, Your Honor.
MR. CONRAD: No objection.
JUDGE NEWMAN: It's admitted.
(DATABASE REPORT MARKED AS DEFENDANT'S EXHIBIT NUMBER 41 WAS RECEIVED INTO EVIDENCE.)
MR. BARBER: And publish, please.
MR. BARBER: So this looks similar, and we say that it says that Siri and it says begin and end. What does UI mean?
BRITT DOVE: It stands for User Interface.
MR. BARBER: And so we see here that the user interface is starting and stopping at these various times. Is that correct?
BRITT DOVE: Yes, sir.
MR. BARBER: And what -- on Maggie's phone, what would typically trigger the Siri user interface?
BRITT DOVE: It could be several different things. If it's set up with Siri where there is a word that you say, you know, Siri, or whatever you choose to say, it could activate it when it's listening. It could be hit the button, the power button, to activate it. It could be several different things.
MR. BARBER: And hitting the button, is the button on the side of the phone?
BRITT DOVE: Yes, sir.
MR. BARBER: If that's pressed and held for a couple of seconds, it comes on?
BRITT DOVE: Yes, sir.
MR. BARBER: I want to turn -- do you know who a man named Al Johnson is in relation to this case?
BRITT DOVE: Yes, sir, I do.
MR. BARBER: Who is he?
BRITT DOVE: He is a private investigator that does digital forensics, retired from the FBI.
MR. BARBER: And did he do work on this case?
BRITT DOVE: Yes, sir, I believe he did.
MR. BARBER: Okay. Did he do analyses of the phones in this case?
BRITT DOVE: Yes, sir.
MR. BARBER: Have you ever seen those analyses?
BRITT DOVE: I've not seen his completed reports, no, sir.
MR. BARBER: Okay. Have you seen his AXIOM reports?
BRITT DOVE: I have not seen all of his AXIOM reports, no, sir.
MR. BARBER: Well, let me ask this. When you looked at the steps and the time periods for the steps on the -- on Maggie's phone, Paul's phone -- well, let's just talk about Maggie's phone and Alex's phone. Did the steps after 9:00, say, did they ever go together? Were there steps happening on Alex's phone at the same time as Maggie's phone?
BRITT DOVE: I would have to look at the two reports because I looked at them singly. So, I would have to put them together to compare them.
MR. BARBER: Okay. Well, let's find them. This is has been marked as State's 284 and marked into -- and what has been admitted as State's 290. And, sir, just to understand the question, is there anything indicating that Maggie's phone and Alex's phone are moving together in those reports?
BRITT DOVE: Let me look and see to compare the times.
(Break in proceedings.)
BRITT DOVE: No, sir, it doesn't appear so.
MR. BARBER: Okay. If the same person had had both phones on them and one of phones was recording a significant number of steps, would you expect to see the same number of steps or something very similar on the other phone?
BRITT DOVE: I would expect to see steps on both phones, yes, sir.
MR. BARBER: And you would expect to see those steps over about the same time period?
BRITT DOVE: Yes, sir, give or take a minute or two for entry into the database.
MR. BARBER: And then you would roughly expect to see the same number of steps on each phone.
BRITT DOVE: Yes, sir, within a few.
MR. BARBER: Are you familiar with a timeline prepared by Special Agent -- and I hope I'll pronounce him name correctly -- Rudofski. Is that correct?
BRITT DOVE: Yes, sir.
MR. BARBER: Did you assist with the preparation of that timeline?
BRITT DOVE: I reviewed it early on. I have not reviewed anything in the last week or two on it.
MR. BARBER: Well, let me ask about that, early on but not within the last week or two. The case has been investigated for -- since '21. So, were you assisting with that until a couple of weeks ago?
BRITT DOVE: He provided me copies of it previously when it was in a working draft copy just to verify that he was interpreting the information from my reports onto it correctly.
MR. BARBER: And now turning to Alex Murdaugh's vehicle, it was a Chevy Suburban. Is that correct?
BRITT DOVE: Yes, sir.
MR. BARBER: And did you do any work regarding electronics in that vehicle?
BRITT DOVE: No, sir.
MR. BARBER: You had no involvement in anything with that vehicle?
BRITT DOVE: As far as processing the data, no, sir. I just took the items that were seized from the vehicle as far as infotainment center and prepared them and sent them to the FBI to be processed.
MR. BARBER: Have you ever seen any of the results from the FBI processing?
BRITT DOVE: Yes, sir, I have.
MR. BARBER: Okay. So, now I want to turn and start going through some of the text messages on Maggie's phone and then we'll --
(Break in proceedings.)
MR. BARBER: This may be a little hard to read, sir, but do you recognize what's been marked as Defendant's Exhibit 54?
BRITT DOVE: It appears to be a report for I-messages, SMS, and MMS messages.
MR. BARBER: And is this a report you prepared?
BRITT DOVE: No, sir. I don't recognize this report.
MR. BARBER: I mean, are you certain about that, sir? This was produced in the extractions. This is the AXIOM report.
BRITT DOVE: Yes, sir, but I did not prepare it like this.
MR. BARBER: It's a webpage on the computer, correct, sir?
BRITT DOVE: Yes, sir, it's an HTML page.
MR. BARBER: And this is just a printout of that.
BRITT DOVE: It says print this page at the top, so I would assume that it is, yes, sir.
MR. BARBER: Sir, can you read under source, say, on the third entry?
BRITT DOVE: On the third entry of source? Yes, sir.
MR. BARBER: Do you see where it says CCRED, and then it says read network local slash and root and Dove with your name? Do you recognize any of that?
BRITT DOVE: Yes, sir. That's the file path for our evidence server with this item the extractions contained.
MR. BARBER: Okay.
MR. BARBER: Your Honor, at this time I would offer Defendant's Exhibit 54 into evidence.
MR. CONRAD: No objection, Your Honor.
JUDGE NEWMAN: It's admitted.
(TEXT MESSAGE REPORT MARKED AS DEFENDANT'S EXHIBIT NUMBER 54 WAS RECEIVED INTO EVIDENCE.)
MR. BARBER: So ,this is --
MR. BARBER: Could we please publish? And could we zoom in so that the left side of the screen is a little larger? Zoom in so the left side of the screen is large and visible to the jury. That's good.
MR. BARBER: Now, Lieutenant Dove, the times and the time column here are UTC, so we'll need to subtract 4 hours from them. Is that correct?
BRITT DOVE: Yes, sir.
MR. BARBER: Okay. So -- and this is a listing of text messages that Maggie Murdaugh sent or received?
BRITT DOVE: Yes, sir, it is.
MR. BARBER: So the second entry there, what's the time for that message?
BRITT DOVE: The time -- it shows the message sent time is June 7, 2021. It shows it at 7:55:26 p.m., but to correct it to Eastern Standard Time at that point would be 3:55:26 p.m. That's with minus four UTC.
MR. BARBER: Okay, and the -- is this incoming or outgoing message?
BRITT DOVE: This records it as a message that was sent.
MR. BARBER: And does this message say -- well, can you read the message?
BRITT DOVE: It says: TY. I'm waiting at doctor. Alex wants me to come home. I have to leave door open at Edisto but trust Mexicans to shut and lock for me. His dad is back in hospital. The last doctor claims no cancer. It's pneumonia.
MR. BARBER: Okay, and does this continue on to three? Well, let's just continue. Can you read number three?
BRITT DOVE: Yes. It's hard to tell where it separates on this report, but there is two emojis and it says: Alex is about to die. Hope he doesn't go down there to sleep. Alex needs to take care of himself as well.
MR. BARBER: And what was the time on that one?
BRITT DOVE: That text message was June 7th of 2021; it shows it at 7:57:16 p.m. To correct to UTC minus four would be 3:57:16 p.m.
MR. BARBER: And then if we come down to number five, that's an incoming message from Mr. Murdaugh, isn't it, that we looked at before?
BRITT DOVE: Yes, sir.
MR. BARBER: And what does it say?
BRITT DOVE: It says: How's your doctor appointment. Or a-p-p-t.
MR. BARBER: And if we go to the second page and number six there, is that an outgoing message?
BRITT DOVE: It shows it as a received and read message.
MR. BARBER: Okay, and what does it say?
BRITT DOVE: It says: Yes, he does. He told me he was tired when he left. I hope they can treat Mr. Randolph, at least to make him comfortable.
MR. BARBER: Now the next one, number seven, is that a reply to the how was your doctor visit message?
BRITT DOVE: Yes, sir, it appears so.
MR. BARBER: And what does it say?
BRITT DOVE: Waiting as usual.
MR. BARBER: And number eight, is that an outgoing message?
BRITT DOVE: It is a sent message, yes, sir.
MR. BARBER: And what does it say?
BRITT DOVE: It says: I'm scared for him and Alex and all of us.
MR. BARBER: In the context of these text messages, do you understand that to be -- referred to as Mr. Randolph Murdaugh's medical condition?
BRITT DOVE: Yes, sir, I do.
MR. BARBER: And what's the time on that?
BRITT DOVE: That time is June 7, 2021. It shows at 8:06:43 p.m. To correct it to minus four UTC would be at 4:06:43 p.m.
MR. BARBER: Okay, and number nine, what does -- is that incoming or outgoing?
BRITT DOVE: It shows it as a received and read text message.
MR. BARBER: Okay. What does this text message say?
BRITT DOVE: It says: I know. Just pray about it and hope he gets a little better. Alex and you really need to relax. Always being on the go with little to no sleep is not healthy. Remember that I have a doctor's appointment in the morning in Beaufort. If I get done early I will go to Moselle. I'll let you know.
MR. BARBER: Let's skip down to page 4, which I believe will be our next message from Mr. Murdaugh, and we're looking at number 18. Is this an incoming message from Mr. Murdaugh?
MR. WATERS: Your Honor, I apologize. I believe a juror raised his hand.
JUDGE NEWMAN: Yes, sir.
UNIDENTIFIED JUROR: Yes, Your Honor. We're having a little difficulty seeing this. If they could blow it up just a little bit?
JUDGE NEWMAN: All right, can't see the small print.
MR. BARBER: If we could make the message text in particular with the date. Yeah.
(Break in proceedings.)
JUDGE NEWMAN: Proceed.
MR. BARBER: Thank you. Your Honor, I would ask the Court to please ask the jury if they can now see everything.
JUDGE NEWMAN: Can you -- is there anyone who cannot see? Proceed.
MR. BARBER: Thank you, Your Honor.
BY MR. BARBER:
MR. BARBER: Line 18, who is this text message from?
BRITT DOVE: The text message, it shows the client, or the chat ID is 1-803-942-1227.
MR. BARBER: Is that Alex Murdaugh?
BRITT DOVE: Yes, sir.
MR. BARBER: Okay, and what is the time of this message?
BRITT DOVE: The time of this message is June 7, 2021, 11:05:55 p.m. To correct to minus UTC, it's going to be 7:05:55 p.m.
MR. BARBER: Okay, and what does the message say?
BRITT DOVE: Paul says: You get -- or Paul says: You were getting pedi. Call when you get done.
MR. BARBER: And there are two examination marks after pedi, correct?
BRITT DOVE: Yes, sir, correct.
MR. BARBER: Showing some -- and pedi you would understand to mean pedicure?
BRITT DOVE: Yes, sir, to the best of my knowledge it is.
MR. BARBER: Now, number 20 would be the next text message from Mr. Murdaugh, and what is the time on that?
BRITT DOVE: The time on that on the paper is June 8, 2021, at 1:08:58 a.m. To correct the time to minus four UTC would make the day June 7, 2021, at approximately 9:00 -- 9:08:58 p.m.
MR. BARBER: And what does this one say?
BRITT DOVE: Going to check on M, be right back.
MR. BARBER: And then finally number 21, I'll just ask. Is this at 9:47 and 23 seconds p.m.?
BRITT DOVE: Yes, sir, once it's corrected for the UTC.
MR. BARBER: And what does this say?
BRITT DOVE: It says: Call me, babe.
MR. BARBER: And who is it from?
BRITT DOVE: It's from the same phone number of 1-803-942-1227, and that phone number is for Alex Murdaugh.
MR. BARBER: I want to ask about that 9:08 text message because I think the State talked about that a bit. Let me ask this. Do you know when that text message was actually displayed on Maggie Murdaugh's phone?
BRITT DOVE: I would have to check the report to see if it actually shows the display time or whether it recorded it or not, but I believe it was the 9:08 mark.
MR. BARBER: We'll come back to that. Let's talk now a bit about the timeline from about 8:50 p.m. to that 9:08, all right, very narrow and getting into some real detail on it.
MR. BARBER: And if I have an easel?
(Break in proceedings.)
MR. BARBER: I'm going to ask about some times, and you may need to refer to the reports. If so, let me know and I'll hand them up.
BRITT DOVE: Yes, sir.
MR. BARBER: First let's just talk about Paul's phone. We established that it locked at 8:49 and 1 second. Is that correct?
BRITT DOVE: Yes, sir.
MR. BARBER: And it did not unlock again.
BRITT DOVE: Correct.
MR. BARBER: And it was at two percent battery?
BRITT DOVE: Yes, sir.
MR. BARBER: So, we don't really know much about what happened after that time from his phone, do we?
BRITT DOVE: Just what was recorded in the logs.
MR. BARBER: Was anything recorded in the logs after 8:49 and 1 second?
BRITT DOVE: Yes, sir. It was still showing that there was some activity going on as far as, like, GPS coordinate and things of that nature.
MR. BARBER: When was the last activity? Well, let me rephrase that. When was last activity indicating human use of the phone?
BRITT DOVE: Was the time that it was locked.
MR. BARBER: Okay, and so we don't know what the person with the phone was doing after that. We can't tell from the phone, can we?
BRITT DOVE: I can't tell if a person was using the phone. It doesn't appear so, but the phone, because it was still on, was still running things in the background.
MR. BARBER: Okay, and I want to talk a lot about Maggie's phone. So on Maggie's phone, was the display off from 8:49 and 28 seconds to 8:53 and 8 seconds?
BRITT DOVE: That sounds right. I would have to verify that with the report to be 100 percent.
MR. BARBER: Okay. Do you have the report on hand?
BRITT DOVE: No, sir, I don't.
MR. CONRAD: It's 283, I believe.
MR. BARBER: I've just handed you what's been and admitted as State's 283, which is the timeline report for her phone.
BRITT DOVE: Yes, sir.
MR. BARBER: So is that correct, that time period for display off?
BRITT DOVE: Could you repeat the time so that I can verify it, please?
MR. BARBER: It is 8:49 and 28 seconds is -- the display goes off. Is that correct?
BRITT DOVE: Give me one second to get to it. 8:49 and 28 seconds?
MR. BARBER: Yes, sir.
BRITT DOVE: Yes, sir. It shows that's the end time of the display on.
MR. BARBER: Is there an orientation change at that time, too?
BRITT DOVE: It shows an orientation change at 8:49:28. It goes to landscape, so there is the same time.
MR. BARBER: And 2 seconds later is the phone locked?
BRITT DOVE: It said 8:49:31 p.m. It shows the start time of being locked.
MR. BARBER: Okay. Our next event at 8:53:08. Does the display come back on?
BRITT DOVE: Yes, sir, it does.
MR. BARBER: The phone is still locked but the screen is on. Is that correct?
BRITT DOVE: Yes, sir, that's what it's showing.
MR. BARBER: And is there an orientation change at 8:53 and 12? 4 seconds after the screen came on?
BRITT DOVE: Yes, sir, it goes to portrait.
MR. BARBER: And we have in this -- kind of starting at this time period starting at 8:53:15 with Apple Health, don't we have her waking some distance?
BRITT DOVE: Yes, sir, I believe so. I believe it recorded some steps then. I would have to refer to that report.
MR. BARBER: Please do.
BRITT DOVE: Yes, sir. It starts out 8:53:15 p.m. recording 59 steps and ends at 8:55:32.
MR. BARBER: Do you have any way to know the distance that that covered?
BRITT DOVE: No, sir. It just says it recorded 59 steps, and then it shows on there a duration in minutes, which is approximately 2.29.
MR. BARBER: Is the distance, is it on the phone? Is it available to be found?
BRITT DOVE: As far as distance as far as in yards or --
MR. BARBER: Meters.
BRITT DOVE: It -- I have seen it in meters, yes, sir.
MR. BARBER: So, that information has been recovered, how many meters that those steps covered?
BRITT DOVE: Yes, sir. When we extracted the information, it would have been part of that.
MR. BARBER: And was that 31 and one-quarters meters?
BRITT DOVE: I would have to look at -- it's not on this report. On the AXIOM report it doesn't put it down in meters. It just does it in feet. I would have to look at one of the other reports, or look at the extraction to know exactly how many meters it is, but it does record in meters.
MR. BARBER: And at the end of that walking period, or about 4 seconds in the report, when does -- well, when does the screen turn off next?
BRITT DOVE: I show it display off at 8:53:28 is the start time of that, and then the next display off is at 8:53:44 p.m.
MR. BARBER: Well, let's stick with the 8:53:28 it went off, correct?
BRITT DOVE: Yes, sir. That shows the start time of it being off.
MR. BARBER: Okay, and did it come back on 4 seconds after that?
BRITT DOVE: Yes, sir. It comes on at 8:53:32 p.m.
MR. BARBER: Now, the exhibit I previously showed you about Siri, when does the -- when is the last activation of the user interface for Siri?
BRITT DOVE: The last one shows that it started on June 7, 2021, at 8:53:20 p.m.
MR. BARBER: Okay. So, it's during this period of walking.
BRITT DOVE: Yes, sir.
MR. BARBER: And we covered previously that holding the side button can trigger that.
BRITT DOVE: It's one of the things, yes, sir, that could trigger that.
MR. BARBER: Now, the screen had gone off at 8:54:32. Is that correct?
BRITT DOVE: At 8:54:32 is the end time of display off.
MR. BARBER: I apologize. 8:53:44 it came on, correct? The display went off, and then it went back on at 8:55:04. Is that correct?
BRITT DOVE: Let's see. I show display off starts at 8:53:44. It ends at 8:55:32. Display on at 8:55:32 is when it starts with the display on. And then it shows that ending at 8:55:04.
MR. BARBER: So, at 8:55:32 the display comes on, and 2 seconds later is a camera application use.
BRITT DOVE: At 8:55:32?
MR. BARBER: At 8:50 -- I'm sorry. At 8:54:32 the screen comes on.
BRITT DOVE: Yes, sir.
MR. BARBER: 2 seconds later there's a -- the camera is activated. Is that correct?
BRITT DOVE: Yes, sir.
MR. BARBER: Was the camera activated from the locked screen? In other words, the phone was not unlocked to get to the camera.
BRITT DOVE: It doesn't appear that there's an unlocked sequence, but I would imagine not just based off of that. I don't see the unlocking.
MR. BARBER: Is there metadata in the KnowledgeC database that would allow you to determine whether this was activated from the locked screen?
BRITT DOVE: There may be. I've never looked that far into it to see if that's there.
MR. BARBER: So, the screen comes on. The camera is activated. It stays on for how long?
BRITT DOVE: It comes on at 8:54:34 and goes off at 8:54:35, so approximately 1 second.
MR. BARBER: Okay, and we're still in that walking period, correct?
BRITT DOVE: Yes, sir.
MR. BARBER: Now, 5 seconds later we have an orientation change?
BRITT DOVE: The orientation changed to landscape begins at 8:54:40, yes, sir, approximately 5 seconds.
MR. BARBER: So let's -- so in a space of 6 seconds -- let me correct that, 8 seconds, the screen came on, camera opened, closed, and then orientation change. So, a lot happening in that 8 seconds.
BRITT DOVE: I don't know that the camera came on. I know that it was shown an application usage log. Whether somebody activated the camera to use it or not, I don't know that.
MR. BARBER: And then when did the display go off?
BRITT DOVE: It shows display off at 8:55:04 p.m.
MR. BARBER: Okay, and it was an orientation change then, too, correct?
BRITT DOVE: Yes, sir, it went to portrait.
MR. BARBER: Okay, and did the display come on again shortly thereafter, 28 seconds later?
BRITT DOVE: Yes, sir, at 8:55:32 p.m.
MR. BARBER: And then it went off and it stayed off until 9:03, correct?
BRITT DOVE: Yes, sir. The display went off at 9:03:52 p.m.
MR. BARBER: So -- and then what we would have after that would be some incoming calls that go unanswered. Until we get to orientation change at 9:06, is there anything else happening on the phone?
BRITT DOVE: There's other things that were recorded in the logs. Because it will record in the logs that it received a phone call, so you get that. You get the phone calls --
MR. BARBER: And the phone call, when was that?
BRITT DOVE: It shows a phone call at 9:04:23 p.m.
MR. BARBER: And I think we've had previous testimony on that. That was from Alex Murdaugh, correct?
BRITT DOVE: Yes, sir, correct.
MR. BARBER: Okay, and then we have the final orientation change at 9:06 and 12, which has a start time of 9:06 and 12, and an end time of 9:06 and 20, correct?
BRITT DOVE: Yes, sir. That's when the orientation changes to portrait.
MR. BARBER: Okay, and in that time period we have another call from Alex Murdaugh, correct?
BRITT DOVE: Yes, sir, at 9:06:14 p.m.
MR. BARBER: And then another one coming in at 9:06:51. Is that correct?
BRITT DOVE: Yes, sir, that's correct.
MR. BARBER: Okay, and then the display after that goes off.
BRITT DOVE: Yes, sir, it goes off at 9:07:00 p.m.
MR. BARBER: And that text message we talked about earlier at 9:08:58, did the screen come on when that came in or did it stay off?
BRITT DOVE: It looks like when the display off ended was at 9:31:44 p.m.
MR. BARBER: Okay. Is that when that text message was actually delivered?
BRITT DOVE: It shows text message received on the phone at 9:08:58 p.m.
MR. BARBER: But the screen did not come on until 9:31.
BRITT DOVE: Correct.
MR. BARBER: We mentioned the -- that you had seen the vehicle -- strike that. We talked about Alex Murdaugh's steps. Did he have a period of walking that went from about 9:02 to 9:06 and 47 seconds?
BRITT DOVE: I would have to refer to that report.
MR. BARBER: Please do.
(Break in proceedings.)
BRITT DOVE: I'm sorry, could you give me the times on that again?
MR. BARBER: It's about 9:02 time period. It ends at 9:06 and 47 seconds.
BRITT DOVE: Yes, sir. It shows that the phone recorded 283 steps.
MR. BARBER: Do you recall from the report you got from the FBI about his vehicle if anything was recorded happening in his vehicle at 9:06 and 58 -- and 48 seconds?
BRITT DOVE: I don't remember. I remember looking in the report, but I haven't studied that report, so I don't know.
MR. BARBER: You don't recall that the report shows that the car engine was started at that time?
BRITT DOVE: I would have to look at that report. Like I said, I looked at the report when it first came back, but I have not studied that report because that was not part of what I examined.
MR. BARBER: Was information from that report included in the timeline you assisted Agent Rudofski with?
BRITT DOVE: Yes, sir, I believe it was.
MR. BARBER: If you were to look at that timeline that the agent prepared, would that help refresh your memory?
BRITT DOVE: Yes, sir. I could look at it and see what the report says.
MR. BARBER: It's is a copy of his timeline report. Do you recognize that that's what it is?
BRITT DOVE: Yes, sir, that's what it appears to be. Are you wanting me to look for the vehicle information on there?
MR. BARBER: Yes.
MR. CONRAD: Object, Your Honor. This is a -- what's going to be a State's Exhibit. The State does not object if we'll just go ahead and admit it as a defense exhibit at this time, but I don't know what Mr. Barber's intention is.
MR. BARBER: Your Honor, I was using this to refresh witness's recollection, Rule 612.
JUDGE NEWMAN: What is the objection?
MR. CONRAD: If he's going to review that, the State would ask that it be marked and admitted because this is not a report personally prepared by Lieutenant Dove.
JUDGE NEWMAN: Would you like to have it admitted as a State's exhibit or a defense exhibit?
MR. BARBER: I'm happy to admit it as a defense exhibit, Your Honor. It's not premarked however.
JUDGE NEWMAN: It will be admitted as a defense exhibit.
(Break in proceedings.)
COURT REPORTER: Defense 60.
(VEHICLE REPORT MARKED AS DEFENDANT'S EXHIBIT NUMBER 60 WAS RECEIVED INTO EVIDENCE.)
MR. BARBER: I'm handing you back now what's now been marked as Defense Exhibit 60, which will make this a lot quicker and easier. Did you find what we were talking about?
BRITT DOVE: Yes, sir, I did.
MR. BARBER: And when did Mr. Murdaugh's car start?
BRITT DOVE: According to this timeline that's been prepared, it looks like it starts at 9:06:48 p.m.
MR. BARBER: And that is a second after the end of that period of walking around?
BRITT DOVE: Yes, sir.
MR. BARBER: Would it be fair to describe that period of walking around as Mr. Murdaugh walking to his car?
BRITT DOVE: I can just say the phone recorded steps. I can say what this report has as far as the vehicle information. Now, whether somebody was walking to their car, from their car, or just walking around an area I can't say because I wasn't there, but I can just say what the information contained on there.
MR. BARBER: Did his phone connect to the Bluetooth system in his car?
BRITT DOVE: I did not find connections during that timeframe.
MR. BARBER: Did you look at his car -- when I -- I apologize. Did the FBI find a connection to the system in his car, not on his phone?
BRITT DOVE: I don't see it in this section. It talks about the vehicle stuff in the 9:06 period.
MR. BARBER: I'll come back to that in just a second. If a phone were thrown from the window of a moving car going down a country road, would you expect -- and the screen was on at that time because there was an incoming call, would you expect to see an orientation change?
BRITT DOVE: Depends on how it was thrown, but if it was just thrown end-over-end, then I would expect the orientation change.
MR. BARBER: Okay, and this phone was recovered on the side of the road. You're aware of that.
BRITT DOVE: Yes, sir.
MR. BARBER: About 15 feet, we've had testimony about that, in some brush on the side of a country road, not so far from the Mr. Murdaugh's house but half mile or so at least. If that would make an orientation change, and that the last orientation ever on the phone until it's recovered is 9:06 and 12 seconds, 9:06 and 20 seconds, is it reasonable to believe that that is it being thrown out the window to its final resting place before it is recovered?
BRITT DOVE: It's hard for me to say. I can just testify about what information is on the phone. If somebody throws -- there's different ways to throw things. You can throw things end-over-end, straight, you can throw it sideways, you can take and toss something is considered a throw. It's hard for me to say that because depending on how it's thrown, what it hits when it tumbles to the ground, or how it lands could cause different things to happen.
MR. BARBER: Okay. Based on the information in front of you, would it be possible for the person who is cranking that car at 9:06 and 48 seconds to be throwing it from that car while it's moving at 9:06 and 12 to 20 seconds?
BRITT DOVE: Anything is possible. I don't know --
MR. BARBER: If the person driving were Alex Murdaugh -- because he's having to walk for a few minutes before he gets in the car, right?
BRITT DOVE: I don't know how he throws things, how he handles things, so it would be hard for me to say how they would do that.
MR. BARBER: So, what I'm asking is if he walked from 9:02 until the second before he gets in the car and cranks it, and that is it looks like 30 seconds after the phone is thrown on the side of the road a half mile away, can he be in two places at once?
BRITT DOVE: I don't know that that's the time of the throw, the phone was thrown. I know that's the time the orientation change occurred. Now, that does not mean that the phone was thrown at that moment. It's hard for me to say.
MR. BARBER: Certainly it is possible that it was a random orientation change, and somebody throws the phone out of the moving car going down this country road, lands in some brush 15 feet off the road by some, you know, miracle golf frisbee shot, but you would expect if you would throw the phone out the window like that you would get an orientation change if the screen is on.
BRITT DOVE: If it's thrown like you described with it thrown like a golf frisbee kind of throw, I don't expect the orientation change because it's going to -- it could land flat.
MR. BARBER: So -- but that would be unusual, wouldn't it, that you could throw it from a moving car and it can land 15 feet in the woods and not ever bounce in a way that would cause an orientation change.
BRITT DOVE: I've never tested throwing a phone out the window to see what the orientation change looks like. Like I said, I can just testify as to what's in the records on it.
MR. BARBER: And at the time, if this is when it is thrown, at that very moment there's an incoming call from Alex Murdaugh, the screen is lit up with his name on it, correct?
BRITT DOVE: Yes, sir.
MR. BARBER: Okay. It would be reasonable that if somebody had taken the phone, they see it starts to ring with his name on it, they might chuck it out the window.
BRITT DOVE: It is possible if they see that, yes, sir.
MR. BARBER: That would be consistent with all of the information on the cell phones, would it not?
BRITT DOVE: It's consistent with the information on the cell phones. Whether it's somebody who saw the number coming in, or they even saw the number coming in, I can't say because I was not there.
MR. BARBER: I understand you were not there. And the question is really in your review of these records, is that not just consistent, but reasonably consistent, something that would make sense to -- you know, to you that that is one reasonable possibility consistent with what you see on these phones?
BRITT DOVE: If somebody was holding a phone and they saw a number come in and they didn't want to answer or didn't want, then to throw it, that is a possibility, yes, sir.
MR. BARBER: And that the last orientation change before law enforcement finds it in the woods on the side of the road the next day recorded when it was tossed out the window.
BRITT DOVE: I can't say that. I can just say that there's --
MR. BARBER: But that would be reasonable.
BRITT DOVE: I can just say there was an orientation change. I cannot say that's when the phone was thrown was -- that caused that change to portrait.
MR. BARBER: And at the time -- and at -- less than 30 seconds after that Alex Murdaugh -- well, at that time he's walking, isn't he? He's not in a car.
BRITT DOVE: The phone recorded steps in the timeframe.
MR. BARBER: And you testified on direct that if you're riding in a car, it's not going to record steps, correct?
BRITT DOVE: Correct.
MR. BARBER: So, he's not in a car at that time.
BRITT DOVE: I can't say where he was or wasn't. I wasn't there. I can just say what the phone recorded, whether it recorded steps or not.
MR. BARBER: Well, that's fair. The person in possession of his phone was not in the car at that time, 9:06 and 12 seconds.
BRITT DOVE: I can just say the phone -- that somebody had the phone and it recorded steps.
MR. BARBER: Right, and you also have testified that if you're in a car, it would not record steps.
BRITT DOVE: Correct. If you put it in a cup holder and ride around in a car, it's not going to record steps.
MR. BARBER: So if you -- if this phone were in a car at 9:06 and 12 seconds, it would not record any steps.
BRITT DOVE: Correct.
MR. BARBER: And it did -- in fact, did not record steps at that time.
BRITT DOVE: At what time it ended, the last ones I see is the steps on that timeframe.
MR. BARBER: I mean, it did record steps at that time.
BRITT DOVE: Yes, sir.
MR. BARBER: So, the person who had Alex Murdaugh's phone was walking at this 9:06 and 12 seconds time because it's recording steps.
BRITT DOVE: Yes, sir. Somebody was holding the phone and recording steps.
MR. BARBER: And he's also calling his wife in this time period.
BRITT DOVE: Yes, sir, there are phone calls.
MR. BARBER: He's walking and calling his wife and he is about -- his car is about to crank a second after he stops walking, which really does seem like he's getting in the car.
BRITT DOVE: That's what it would appear with the times, but like I said, all I can testify to is what the information is on the devices.
MR. BARBER: Did Alex Murdaugh have the code to unlock Maggie Murdaugh's phone?
BRITT DOVE: I don't know. I've been told he did. I was provided the code when I received the phone.
MR. BARBER: So, you don't really have any -- you can't really testify as to why he would take his wife's phone, and then I guess, as the State alleges, and throw it out the window of his car a half a mile from his house.
BRITT DOVE: No, sir. I have no idea what people are thinking or do the things that they do.
MR. BARBER: And we have previously established that his phone and Maggie's phone were not -- when he's walking they're not walking together. Is that correct?
BRITT DOVE: Correct. There are no steps recorded on the devices together.
MR. BARBER: So he's walking without her phone. Her phone does an orientation change while he's walking without her phone. Is that correct?
BRITT DOVE: I can just say both devices were not recording steps at the same time.
MR. BARBER: And they're not recording steps at the same time, and he's walking at 9:06:12.
BRITT DOVE: Correct.
MR. BARBER: Therefore, hers is not recording steps at 9:06:12?
BRITT DOVE: Correct.
MR. BARBER: So his phone is walking, hers is not at the time her phone has this final orientation change before it's found on the side of road.
BRITT DOVE: Yes, sir.
MR. BARBER: Okay, and in your twenty-some years' experience in law enforcement, that doesn't make it seem reasonable to you that he did not -- that the person who had Alex's phone did not also have Alex's phone at 9:06 and 12 seconds?
BRITT DOVE: It appears the phones were not together being moved by the same person because they are not recording steps.
MR. BARBER: I'm going to switch off of the timeline a little bit and ask. Were you aware of a Cellebrite logical extraction of Alex's phone that was conducted on June 10th?
BRITT DOVE: I have been told there was one conducted, yes, sir.
MR. BARBER: Did you ever receive that?
BRITT DOVE: I received a copy of it several months back.
MR. BARBER: Did you receive it after you did the full file extraction?
BRITT DOVE: Yes, sir.
MR. BARBER: So, there's really not -- it wasn't very useful to you at that point, was it?
BRITT DOVE: No, sir. I was working off of my extraction because I was able to obtain the full file system, which gives me more information than an advanced logical would do.
MR. BARBER: I want to turn to Maggie's phone and the recovery of that. I think you testified earlier, was it -- is it your understanding it was recovered in the afternoon of the day after 6 -- June 8th?
BRITT DOVE: My understanding, it was recovered June 8th. The approximate time it was recovered or timeframe I'm not 100 percent sure of.
MR. BARBER: I'm going to show you what has been marked as Defendant's Exhibit 42.
BRITT DOVE: Yes, sir.
MR. BARBER: Do you recognize this form?
BRITT DOVE: Yes, sir, I do.
MR. BARBER: And what is it?
BRITT DOVE: It is our evidence intake form for the Computer Crime Center.
MR. BARBER: Your Honor, Mr. Murdaugh would offer this as Defendant's Exhibit 42 into evidence.
MR. CONRAD: No objection.
JUDGE NEWMAN: It's admitted without objection.
(EVIDENCE INTAKE FORM MARKED AS DEFENDANT'S EXHIBIT NUMBER 42 WAS RECEIVED INTO EVIDENCE.)
MR. BARBER: Is this the intake form for Maggie Murdaugh's phone?
BRITT DOVE: Yes, sir, it is.
MR. BARBER: Could we, please, publish Exhibit 42?
(Break in proceedings.)
MR. BARBER: And while we do that, what's the date on the form?
BRITT DOVE: The date on the form is June 9th of 2021.
MR. BARBER: Is that when her phone came to you?
BRITT DOVE: Yes, sir.
MR. BARBER: So, you didn't have it from -- on the same day they recovered it? It was the next day?
BRITT DOVE: Correct.
MR. BARBER: On this form, do you see where it says subject's name? What does subject's name mean?
BRITT DOVE: It's just the name of a subject, whether it be a victim, a witness, suspect, anything else that would be provided by the investigator for it.
MR. BARBER: And here where is says subject name unknown, would you understand that to mean the subject to be the person who committed the homicide?
BRITT DOVE: No, sir. Like I said, it was just a subject name. It could -- we get them that are witnesses. Some are victims. Some are suspects. It's just a subject's name.
MR. BARBER: Well, down here under keywords, do you see where it says urgent request and it's ticked yes?
BRITT DOVE: Yes, sir.
MR. BARBER: And what's the reason for that request?
BRITT DOVE: It says unknown suspect.
MR. BARBER: And again, given that this is a homicide, doesn't this indicate that at this time they're saying we don't know who committed this homicide, there's some urgency about looking at the victim's phone?
BRITT DOVE: Yes, sir.
MR. BARBER: I'm going to stick with Maggie's phone, but really quickly I want to just quickly turn to Paul's. I show you what has been marked as Defendant's Exhibit 46. Do you recognize that?
BRITT DOVE: Yes, sir, do.
MR. BARBER: And what is it?
BRITT DOVE: It's an evidence intake form for the Computer Crime Center at SLED.
MR. BARBER: Your Honor, I would offer Defendant's 46 into evidence.
MR. CONRAD: No objection.
JUDGE NEWMAN: It's admitted.
(EVIDENCE INTAKE FORM MARKED AS DEFENDANT'S EXHIBIT NUMBER 46 WAS RECEIVED INTO EVIDENCE.)
MR. BARBER: Lieutenant Dove, this -- is this the intake for Paul's phone?
BRITT DOVE: I believe it to be so, yes, sir.
MR. BARBER: At which you got on August 13th. I believe we had testimony on that.
BRITT DOVE: Yes, sir.
MR. BARBER: Is it a urgent request?
BRITT DOVE: No, sir, it's not checked yes or no.
MR. BARBER: Is there anything written on here that indicates that the subject is unknown?
BRITT DOVE: No, sir, the subject line is blank.
MR. BARBER: Okay. I'm going to turn back to Maggie's phone. Do you recognize this?
BRITT DOVE: Yes, sir, I do.
MR. BARBER: And what is it?
BRITT DOVE: It's an examination worksheet for mobile devices.
MR. BARBER: And this is for Maggie's phone?
BRITT DOVE: Yes, sir.
MR. BARBER: Your Honor, I would offer this as plaintiff's -- Mr. Murdaugh's Exhibit Number 43.
MR. CONRAD: No objection.
JUDGE NEWMAN: It is admitted.
(WORKSHEET MARKED AS DEFENDANT'S EXHIBIT NUMBER 43 WAS RECEIVED INTO EVIDENCE.)
MR. BARBER: This has this -- let's just ask this. When did you perform the full file system extraction on Maggie Murdaugh's phone?
BRITT DOVE: On June 16, 2021.
MR. BARBER: And that was eight days after it was recovered, correct?
BRITT DOVE: Yes, sir.
MR. BARBER: And why was there an eight day delay?
BRITT DOVE: I attempted to process it. I was only able to get a partial extraction originally from the device. It would not process fully with the IOS and the model of that phone. I did do an advanced logical to get some information off for the investigators since it was an unknown suspect. Then on the 15th of June of 2021, GrayKey updated the software and then I reran it the next day with the updated software to get a full file system.
MR. BARBER: Is it fair to say that essentially there was some technical difficulties and you were unable to do it for eight days?
BRITT DOVE: It was just that at the time, GrayKey did not support that model and that IOS. It's not difficulties. It's just that it did not support it.
MR. BARBER: Okay, and during that eight day period, could any -- would anything have been lost on the phone? We've talked a lot about how things can go pretty quickly on some of these tables. Was anything lost during that time?
BRITT DOVE: Some of the location data from GPS systems since the phone came in in airplane mode could have been overwritten.
MR. BARBER: Okay, and I think we talked before that that's -- that's in one these SQLite databases like called cache?
BRITT DOVE: Yes, sir.
MR. BARBER: And I think we even looked at on the Paul -- Paul's phone, the timeline. There was -- the State's attorney pulled out some -- pointed out some GPS locations.
BRITT DOVE: Yes, sir.
MR. BARBER: Was the source of those on the timeline. That was cache, that was cache SQLite database, correct?
BRITT DOVE: Yes, sir, it was.
MR. BARBER: Okay. So, now I want to ask you if you recognize this document.
BRITT DOVE: Yes, sir, I do.
MR. BARBER: And what is this?
BRITT DOVE: It's a database -- it's tables from a database that denote longitude, latitude, timestamps, accuracy.
MR. BARBER: Okay, and for whose phone?
BRITT DOVE: It says on the top Maggie Murdaugh's IPhone.
MR. BARBER: And this is from the cache database?
BRITT DOVE: Yes, sir.
MR. BARBER: And is this actually from the same table in the cache database as was the source in those GPS locations we were looking at on the timeline for Paul's phone?
BRITT DOVE: Yes, sir. They were both cache databases.
MR. BARBER: What is the late -- strike that -- earliest entry on this?
BRITT DOVE: It appears that the first entry is at June 9, 2021, at 2:51:21 p.m.
MR. BARBER: So, that's two days after Maggie Murdaugh was murdered.
BRITT DOVE: Yes, sir.
MR. BARBER: And it took eight days to extract her phone.
BRITT DOVE: Yes, sir.
MR. BARBER: If it had been extracted in six days, would we have this data for the night of the murder?
BRITT DOVE: It's possible. It appears it may be, yes, sir.
MR. BARBER: The -- those -- that latitude and longitude of the oldest entry, do you know where that is?
BRITT DOVE: No, sir. I would have to plot it to know for sure.
MR. BARBER: Would you disagree with me if I said that that's a SLED building, given the date?
BRITT DOVE: No, sir. I would -- I would say that most of these are probably the SLED annex building in Columbia.
MR. BARBER: Okay, and it is. Yesterday you were asked some questions about a Faraday bag, and there was some discussion that often there's no real point if it's already in airplane mode. But you said that one difference between removing the SIM card or airplane mode and a Faraday bag is that the Faraday would block GPS signals. Is that correct?
BRITT DOVE: Yes, sir.
MR. BARBER: If this phone would have been placed in a Faraday bag until whatever the GrayKey issues were could have been resolved, would it have preserved GPS data?
BRITT DOVE: It should have. As long as the Faraday was not defective and sealed properly, then it should have locked GPS.
MR. BARBER: And then we would presumably have GPS data going back to 6/7 or before.
BRITT DOVE: Yes, sir. I would imagine so in that timeframe, yes, sir.
MR. BARBER: Beg the Court's indulgence.
(Break in proceedings.)
MR. BARBER: I apologize, Your Honor. Almost done. I don't think I have offered this into evidence. I apologize, Your Honor. I would offer this as Defendant's Exhibit 45.
MR. CONRAD: Was that what he was just looking at?
MR. BARBER: Yes.
MR. CONRAD: No objection from the State.
JUDGE NEWMAN: Admitted without objection.
(DATABASE FROM M. MURDAUGH'S PHONE MARKED AS DEFENDANT'S EXHIBIT NUMBER 45 WAS RECEIVED INTO EVIDENCE.)
MR. BARBER: One, I guess, final question. I said something we would come back to, if I can. It's one of State's exhibits. Do you have 284 up there?
BRITT DOVE: I have 283. Yes, sir, I have 284.
MR. BARBER: I'm sorry, and I said the wrong number. 282, sorry.
BRITT DOVE: That's okay. I have 283, I have 290, and I have 284 up here.
MR. BARBER: Okay. Well, I'll find that one and that will be our last question.
(Break in proceedings.)
MR. BARBER: I've handed you what's been entered as State's Exhibit 282.
BRITT DOVE: Yes, sir.
MR. BARBER: Will you turn to page 16?
BRITT DOVE: Yes, sir.
MR. BARBER: Do you see the text message: Going to check on M, be right back?
BRITT DOVE: Yes, sir, I do.
MR. BARBER: Is there anything on there indicating that it was delivered around 9:31 p.m.?
BRITT DOVE: It shows the time on here that is recorded as June 7, 2021, at 9:08:58 p.m.
MR. BARBER: And in the rest of the information around that text message, do you see anything?
BRITT DOVE: Around this particular text message?
MR. BARBER: Yes, sir.
BRITT DOVE: Just that status is unread.
MR. BARBER: Can I see the exhibit, please?
(Break in the proceedings.)
MR. BARBER: No further questions, Your Honor.
JUDGE NEWMAN: Any redirect?
MR. CONRAD: Just a few things, Your Honor.
REDIRECT EXAMINATION
BY MR. CONRAD:
MR. CONRAD: Mr. Barber asked you about the potentiality of Alex and Maggie's phones being carried at the same time, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And you testified that there were no steps on Alex's phone at or about the 8:55 timeframe when we see steps on Maggie's phone, correct?
BRITT DOVE: Correct.
MR. BARBER: Objection. Leading.
JUDGE NEWMAN: Don't lead the witness.
MR. CONRAD: At 8:55 -- and we can refer to the report again if you need to. Between 8:53 and 8:55, do you see steps on Maggie's phone?
BRITT DOVE: Yes, sir. I see steps from 8:53 and ending at 8:55.
MR. CONRAD: Do you see any steps after that on Maggie's phone?
BRITT DOVE: No, sir, I do not.
MR. CONRAD: And if you want to pick up Alex's steps report, and we'll -- if you don't mind, read -- look at the exhibit number on the back real quick.
BRITT DOVE: It's State's Exhibit 290.
MR. CONRAD: Okay, and would you look at the steps, the timeframe of 8:05 to 9:02 p.m. on June 7th?
BRITT DOVE: Yes, sir.
MR. CONRAD: And do you see any steps on Alex's phone from that entire time period?
BRITT DOVE: From 8:05:35 p.m. to 8:59:52 p.m., it shows 74 steps.
MR. CONRAD: Let me stop. I think you misspoke. The start time was 8:05 and some seconds p.m., correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And what was the end?
BRITT DOVE: The end for that one was 8:09:52 p.m.
MR. CONRAD: Right. All right, and do you see any steps after that prior to 9:02 on Alex's phone?
BRITT DOVE: No, sir.
MR. CONRAD: All right, and that video was recorded again at what time?
BRITT DOVE: The video was recorded -- the camera was started at 8:44:49 p.m.
MR. CONRAD: Okay. All right. Let's talk about this time -- these times that Mr. Barber wrote. All right, and this is the information that Mr. Barber wrote down while he was having you read off these some of these events, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and at 8:55:04, I believe this was a screen on event. Is that correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And if you need to look at the original report, that's fine. All right, and then at 8:54 we see another orientation change, 8:54:40, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And then at 9:06:12 we have an orientation change that starts at 9:06:12, correct?
BRITT DOVE: Let me just verify this seconds real quick.
MR. CONRAD: Sure.
BRITT DOVE: At 9:06:12, yes, sir, I see the start of an orientation change to portrait.
MR. CONRAD: Okay, and 2 seconds later what happens?
BRITT DOVE: It's the call.
MR. CONRAD: From who?
BRITT DOVE: It's from PA on the report, but that's Alex Murdaugh's phone number.
MR. CONRAD: It ends in 1227?
BRITT DOVE: Yes, sir.
MR. CONRAD: And I believe Mr. Barber asked you and I don't -- I can't remember if he wrote it down. What time does the screen turn off -- or is Maggie's phone screen on during that call at 9:06:14? Let me ask you that. You can take a look at the report.
BRITT DOVE: Yes, sir. I see a time ending for the screen on at 9:07:00 p.m., and it looks like the screen started and came on at 9:05:44 p.m.
MR. CONRAD: Okay. So, the screen comes on at 9:05, and it turns off when?
BRITT DOVE: It turns off at 9:07:00 p.m.
MR. CONRAD: And when was the next time Maggie's phone screen turns on?
BRITT DOVE: It turns on at 9:31:44 p.m.
MR. CONRAD: All right. Between 9:07 and 9:31 Maggie's screen is off, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And I think you testified about this but I'm going to ask you again. If the screen is off, will a phone record an orientation change?
BRITT DOVE: No, sir.
MR. CONRAD: And so Mr. Barber was asking you about the phone being thrown at this 9:06:48 timeframe, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And ultimately you can't tell you us exactly when that phone was thrown, correct?
BRITT DOVE: Correct.
MR. CONRAD: With the information that you recovered from this phone, correct?
BRITT DOVE: Yes, sir, correct.
MR. CONRAD: But if that phone had been thrown after 9:07 with the screen off, would you expect to see an orientation change?
BRITT DOVE: No, sir.
MR. CONRAD: If that phone had been thrown at 9:08:58 when that text from Alex comes into -- going to see M -- if it would have been thrown in that time period and it -- would you expect to see an orientation change?
BRITT DOVE: No, sir.
MR. CONRAD: All right, and let's look at Alex's steps one more time. Do you have his report with you handy?
BRITT DOVE: Yes, sir, I do.
MR. CONRAD: Could you hand it to me?
BRITT DOVE: Yes, sir.
MR. CONRAD: This is State's Exhibit 290. Let's look at his steps a little later in the night real quick.
MR. CONRAD: And I'm going to need the ELMO, please.
MR. CONRAD: All right, let's look at record 26. This is something we previously talked about, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And that's 283 steps between 9:02 and 9:06 p.m., correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: All right, and that's Alex's phone, correct?
BRITT DOVE: Yes, sir, it is.
MR. CONRAD: All right, and record 27, what is that? What is indicated in that record, sir?
BRITT DOVE: It shows that the phone recorded 195 steps starting June 7, 2021, at 9:22:39 p.m., and ended at 9:32:14 p.m.
MR. CONRAD: Okay. Record 28, what does this record indicate, sir?
BRITT DOVE: This record shows steps being recorded by the phone of 60 starting June 7, 2021, at 9:35:55 p.m., and ending at 9:45:37 p.m.
MR. CONRAD: Okay. So, at 9:22 there's 195 steps, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And the at 9:35 there is 60 steps, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Now, you've testified and we've talked about this quite a bit. A step count, is that something you can 100 percent rely on as an exact number?
BRITT DOVE: No, sir, it's not 100 percent accurate.
MR. CONRAD: And Mr. Barber asked you about the phone will record distance as well, correct?
BRITT DOVE: Yes, sir. It can record distance and show it in meters.
MR. CONRAD: All right, and you've already testified that steps is not always exactly accurate. In your opinion, the distance that's recorded by a phone from steps, is that generally accurate?
BRITT DOVE: No, sir.
MR. CONRAD: All right, and would the distance that the phone records, would that be, in your opinion, more or less accurate than the steps that are recorded?
BRITT DOVE: The distance that's recorded I would consider to be a little less accurate than I would the steps.
MR. CONRAD: All right, because there's some variables, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Such as?
BRITT DOVE: There's different variables about stride length as far as when somebody is walking. Some people stride further than others. Some people when they walk, they'll walk faster than that so they can cover a greater distance in a short amount of time, but they're using more steps a lot of times because they're not striding maybe as far.
MR. CONRAD: Okay, but we see 195 steps at 9:22, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And 60 steps at 9:35, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: And is 60 less or more than 195?
BRITT DOVE: 60 is less.
MR. CONRAD: And would you expect the distance traveled at 9:35 to be less than the distance traveled at 9:22?
BRITT DOVE: I would have no way of knowing. It just depends on if somebody was up walking around versus sitting down. It's just hard to say.
MR. CONRAD: But more steps were taken at 9:22, correct?
BRITT DOVE: Yes, sir.
MR. BARBER: Objection.
JUDGE NEWMAN: The objection is sustained.
MR. CONRAD: Just a couple of more things.
MR. CONRAD: The defense exhibit, what numbers are they? The text messages exhibit, I don't remember the number.
(Break in proceedings.)
MR. CONRAD: All right, Defense Exhibit 54, please.
BRITT DOVE: Yes, sir, I have it.
MR. CONRAD: You have it?
BRITT DOVE: They brought it up here. I'm sorry.
MR. CONRAD: Sir, would you mind bringing these text messages up?
MR. CONRAD: This is Defendant's Exhibit 54, and I believe Mr. Barber had you read this but I want to make sure he did, and that's -- it looks like entry number two there on the -- that we see up on the screen. Can you read that, please?
BRITT DOVE: Yes, sir. It's June 7, 2021. It's at 7:55:26 p.m., but this is in UTC time, so to go back minus 4 four hours to set it to our time zone would be at 3:55:26 p.m.
MR. CONRAD: All right, and that's 3:25 -- 3:55 in the afternoon, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: Of June 7th, correct?
BRITT DOVE: Yes, sir. That's in the afternoon if you subtract four.
MR. CONRAD: Okay. Read that text, please.
BRITT DOVE: It says: TY. I'm waiting at doctor. Alex wants me to come home.
MR. CONRAD: Alex what?
BRITT DOVE: Wants me to come home. I had to leave door open at Edisto but trust Mexicans to shut and lock for me. His dad is back in hospital. The last doctor claims no cancer. It's pneumonia. And there's some emojis and it says Alex, but I'm not sure if that's going into the next thread or not.
MR. CONRAD: All right, let's go to the second page of that, please. All right, let's -- we want to make this 100 percent clear.
MR. CONRAD: And, sir, can we highlight the time -- actually go back to the first page, excuse me. All right, and highlight, just highlight for us the time on the text entry, the text that he just read where is says 7:55:26. Can you just highlight 7:55:26, please? There you go.
MR. CONRAD: All right, and just want to be 100 percent clear about this. This is Greenwich Mean Time, correct?
BRITT DOVE: Yes, sir, UTC.
MR. CONRAD: Also known as UTC, correct?
BRITT DOVE: Yes, sir.
MR. CONRAD: This is not local time.
BRITT DOVE: Correct.
MR. CONRAD: It is 3:55:26 p.m., correct?
BRITT DOVE: Correct, our time zone.
MR. CONRAD: All right.
MR. CONRAD: Go to page 2, please.
MR. CONRAD: Text entry number six, what time is that in local time? It says 8:03 p.m. Is that in local time?
BRITT DOVE: In local time, I would subtract 4 hours from that. It would be 4:03:14 p.m.
MR. CONRAD: Okay, and what does this text say again?
BRITT DOVE: It says: Yes, he does. He told me he was tired when I left -- when he left. I hope they are treating Mr. Randolph at least to make him comfortable.
MR. CONRAD: Okay. Let's go now to entry number eight, and again what -- and that's 8:06:43 universal time. What is that Eastern time?
BRITT DOVE: It would be subtracting 4 hours; it would be at 4:06:43 p.m.
MR. CONRAD: And what does that text message say?
BRITT DOVE: It says: I am scared for him and Alex and all of us.
MR. CONRAD: It says him. We just read the text, that number six. From the context of this message, who do you think him refers to?
BRITT DOVE: I believe it refers to his father, Mr. Randolph.
MR. CONRAD: Okay, but it says she's scared for Mr. Randolph and who?
BRITT DOVE: And Alex and all of us.
MR. CONRAD: Okay. All right. Mr. Barber asked you about that camera that came on and Maggie's phone, and I believe it was around 8:54 or 8:55. And you can -- if you have that report, if you need to look it up real quick, you can.
BRITT DOVE: Yes, sir, I have it. Do you know what exhibit number it is?
MR. CONRAD: Yeah, if you'll read it.
BRITT DOVE: It's State's Exhibit 283.
MR. CONRAD: All right. So, that camera that came on at -- can you look at the exact time again at -- I think it was 8:54 timeframe?
BRITT DOVE: Yes, sir. It shows an end time of 8:54:35 p.m.
MR. CONRAD: What was the start time?
BRITT DOVE: It was 8:54:34 p.m.
MR. CONRAD: So, that camera was accessed for how long?
BRITT DOVE: 1 second.
MR. CONRAD: All right, and I know you testified that from the data you have, you can't say with 100 percent certainty with how that camera was activated, correct?
BRITT DOVE: Correct. It's just showing as an application usage. It could have been that the camera -- the phone thought it saw something and the camera was activated. It could have been running in the background. For 1 second, it doesn't look like somebody might have touched it to cut it on.
MR. CONRAD: Okay. If it had been someone actually trying to turn on the camera app, would a second of one -- let me rephrase that. In your experience and expertise, you've reviewed phone data that shows cameras being turned on by persons at certain times, correct?
BRITT DOVE: Yes, sir.
MR. BARBER: Objection.
JUDGE NEWMAN: It's overruled.
MR. CONRAD: And when you see a camera activated to be used as a camera, i.e. to take a picture or to take a video, how long is that camera app on generally?
BRITT DOVE: It's usually several seconds to a minute because the camera has to come into focus of the picture it's going to take.
MR. CONRAD: And if a camera app is on for only 1 second, in your opinion, what does that lead you to believe?
BRITT DOVE: Where it's located in the application usage log and for 1 second, to me it would indicate that the phone's camera was possibly looking to see if it recognized a face, or recognized something that was running in the background.
MR. CONRAD: Okay.
MR. CONRAD: If I may have a moment, Your Honor.
(Break in proceedings.)
MR. CONRAD: Nothing further for this witness, Your Honor.
JUDGE NEWMAN: Anything further?
MR. BARBER: Yes, Your Honor, very, very quickly.
RECROSS-EXAMINATION
BY MR. BARBER:
MR. BARBER: On this camera usage, are you familiar with something on the IPhone called SpringBoard?
BRITT DOVE: Yes, sir.
MR. BARBER: And what is SpringBoard?
BRITT DOVE: It's usually things that are set that once you touch them, it'll bring them up to focus as far as with applications and different things.
MR. BARBER: Okay. If the metadata, and I'm trying to say this in understandable fashion, but if KnowledgeC had data about that camera app that indicated usage came from SpringBoard lock screen, would that tell you anything about how the camera was activated?
BRITT DOVE: If it showed it was coming from the locked screen, SpringBoard, it would mean that on your IPhone, if you look at it you have at the bottom right corner a little camera there, that you would be hitting that from there.
MR. BARBER: Okay. Have you checked to see if that metadata is some KnowledgeC for this camera event?
BRITT DOVE: No, sir, I didn't review the SpringBoard metadata.
MR. BARBER: So -- and we saw with -- when the easel was up here there was kind of a little flurry of activity screen on and off orientation changes happened right around when this camera usage happened. And if it were coming from the locked screen, if we had some metadata that would show that, which we may well have, could it be that she was trying to take a picture of someone, say a perpetrator?
BRITT DOVE: For 1 second it would be -- to start and stop in 1 second I would imagine that would be difficult. But could somebody accidentally activate their camera and shut it off? Yes, sir, that is possible.
MR. BARBER: And if the perpetrator, or perpetrators, responded by shooting at her, could that explain why it went off in 1 second and/or a bunch of orientation changes very shortly thereafter?
BRITT DOVE: I would think if somebody went and activated their camera and then they're in fear, they wouldn't think to just shut off the camera.
MR. BARBER: Right, but if they had their finger on the phone, it could happen, right?
BRITT DOVE: There's a lot of possibilities could happen, not knowing how a person reacts.
MR. BARBER: Does the camera app ever store a snapshot of the app? In other words, a screen shot that might have an image even if you didn't take a picture?
BRITT DOVE: I haven't seen that with the camera stuff. I've seen snap shots be captured of apps running in the background.
MR. BARBER: But have you looked through the snapshots in this timeframe, all of ones on the phone? Are they all there?
BRITT DOVE: The ones I looked at -- I did look at one. The last one, from my recollection, was a Facebook that was opened in the background.
MR. BARBER: No further questions, Your Honor.
JUDGE NEWMAN: You may step down. You may step down.
(The witness exited the stand.)
JUDGE NEWMAN: And, ladies and gentlemen, we will break until -- for an hour and 15 minutes, around 2:35.
(The jury left the courtroom.)
(A lunch break was taken.)
(The jury returned to the courtroom.)
COURT BAILIFF: The jury is present, sir.