Parsing the Truth: One Byte at a Time

Few cases have tested digital forensic practice as publicly as the first Karen Read trial. We're breaking down the biggest takeaways so you can apply them where it matters most... your next case.

Richard Green's testified as the digital forensic expert for the defense. We are diving into the first half of his testimony, where he shares the data, identified during the investigation of this case. This is part 1 of 2 for Richard Green's testimony. This is episode 9 of our deep dive into the 2024 Karen Read trial. Testimony provided by: Richard GreenDigital forensics artifacts mentioned: KnowledgeC.dbBiomesSafari / WAL filesCall History Database & WAL filessKey Terms: Hos long to die in coldHow long ti die in cikdExhibits:⁠⁠⁠https://docs.google.com/spreadsheets/d/18lUM6dU2A7JcWSxgZb1t5qLeBkQ26z0h_JBWYPGThXQ/edit?gid=1477225811#gid=1477225811⁠⁠⁠

Nick Guarino's testimony centers on digital artifacts and the analysis of data. We're breaking down the first half of his testimony, where he shares the data he dug into to uncover the facts of this case. This is part 1 of 2 for Nick Guarino's testimony. This is episode 7 of our deep dive into the 2024 Karen Read trial. Testimony provided by: Nick Guarino, TrooperDigital forensics tools mentioned: GrayKeyCellebrite Digital forensics artifacts mentioned: KnowledgeC.dbBiomesSafari / WAL filesCall History Database & WAL filessKey Terms: Hos long to die in coldHow long ti die in cikdExhibits:⁠⁠https://docs.google.com/spreadsheets/d/18lUM6dU2A7JcWSxgZb1t5qLeBkQ26z0h_JBWYPGThXQ/edit?gid=1477225811#gid=1477225811⁠⁠

Ian Whiffin's testimony centers on digital artifacts and data analysis. We are covering the second half of his testimony, in which he shares the data he dug up to uncover the facts of this case. His testimony was very technical and descriptive. This is part 2 of 2 for Ian Whiffin's testimony. This is episode 5 of our deep dive into the 2024 Karen Read trial. Testimony provided by: Ian Whiffin, CellebriteDigital forensics tools mentioned: ArtExCellebrite Digital forensics artifacts mentioned: KnowledgeC.dbbrowserstate.dbcom.app.mobilesafari.plisthistory.dbweb usage logsKey Terms: Hos long to die in coldHow long ti die in cikdExhibits:⁠https://docs.google.com/spreadsheets/d/18lUM6dU2A7JcWSxgZb1t5qLeBkQ26z0h_JBWYPGThXQ/edit?gid=1477225811#gid=1477225811

We continue our deep dive into Jessica Hyde’s testimony, focusing on the second half of her analysis and the critical insights she uncovered. In this portion, she builds on the artifacts and findings introduced earlier, connecting the digital evidence to form a clearer narrative of events. Her testimony is so detailed and technically in-depth that we divided it into two parts. In this episode, we present Part 2 of 2, where the remaining elements of her forensic analysis are brought together to complete the full pictureTestimony Provided By: Jessica Hyde of HexordiaDigital Forensics Tool mentioned:Magnet Axiom ExamineCellebriteiLEAPPDigital Forensics Artifacts mentioned:KnowledgeC.dbcallhistory.storedata com.apple.mobilesafari.plistbrowser state.dbbrowserstat.db-WALKey Terms:Hos long to die in coldHow long ti die in cikdLinks:Jessica Hyde's written report⁠https://drive.google.com/file/d/13dup-E9h3NmD0Tjhzl6Htudx34DQ0x5_/view?usp=sharing⁠List of 2024 Karen Read Trial Exhibits⁠https://docs.google.com/spreadsheets/d/18lUM6dU2A7JcWSxgZb1t5qLeBkQ26z0h_JBWYPGThXQ/edit?usp=sharing⁠Link to ScienceDirect article "Standardization of File Recovery Classification and Authentication."https://www.sciencedirect.com/science/article/abs/pii/S1742287618304602

A single Google search. A disputed timestamp. And a murder trial that ended in a mistrial.In the high-profile Karen Read case, competing digital forensics experts offered contradictory testimony about when a key witness searched “hos long to die in cold” on an iPhone. But let’s take a step back and first review the affidavit that started it all.This session breaks down defense expert Richard Green’s affidavit that challenged the prosecution’s narrative and ultimately won Karen Read access to additional evidence. We’ll discuss the specific artifacts Green analyzed, why context matters, and how no digital evidence artifact stands alone.This is Episode 1 of our deep dive into the 2024 Karen Read trial.Digital Forensics Tool mentioned:Magnet AxiomCellebriteDigital Forensics Artifacts mentioned:KnowledgeC.dbcallhistory.storedata com.apple.mobilesafari.plistbrowser state.dbKey Terms:Hos long to die in coldHow long ti die in cikdLinks:Richard Green Affidavithttps://assets.super.so/669329c3-e11b-4cc8-9a05-1c7f310ff348/files/80f46306-87ad-41c2-a85a-138a816e44b6/Affidavit_of_Richard_Green_in_Support_of_Defendants_Motion_for_Order_Pursuant_to_MASS._R._CRIM._P._17_Directed_to_Brian_Albert_Verizon_and_ATT.pdfDefense Motionhttps://elderlaw.info/wp-content/uploads/2023/09/sj-2023-0343-petition.pdf

Did Leslie Hartman commit suicide, or was it murder? Did her boyfriend, a sheriff's deputy, murder her, or just make the 911 call? Find out how ChromeCache and trace evidence from Discord helped solve the case. Mario Merendon joins us this week to walk us through his role in this case. Mario emphasizes the importance of curiosity, validation, and inter-agency collaboration in digital forensic work. His careful testing and validation of timestamps, web cache data, and chat logs made the difference in solving this complex case. Special Guest: Mario Merendon of VX Digital DefenseFind Mario at https://www.vxdigitaldefense.com/Digital Forensics Tools Mentioned in this Episode:Magnet Forensics AxiomChromeCacheDcodeDigital Platforms Mentioned in this Episode:DiscordKey Topics from this Episode:The importance of verifying digital evidence beyond default tool outputsUtilizing open-source tools like ChromeCache View to dig deeper into web and application cachesCorrelating timestamps from images, chats, and web activity to build a timelineChallenges and solutions in extracting data from wiped phones and encrypted devicesThe significance of validation and testing in building a credible digital caseCollaboration strategies with law enforcement and prosecutors to strengthen findingsLessons learned: curiosity, thorough documentation, and validation as core to successful forensics

David Freyman shares how collaboration helps put together the digital pieces of the Lauren Giddings murder. Learn how hashes of IP addresses, a seemingly innocuous USB drive, and a previously ignored digital camera reveal vital clues that bolster the case.Special Guest: Retired FBI SA David FreymanDigital Forensics Techniques Mentioned in this Episode:MD5 Hashing: Used for verifying data integrity and identifying unique digital signatures.Epoch Time Conversion: A method for interpreting timestamps stored as a series of numbers.File Recovery Software: Utilized to recover deleted video files from a camera.The Lauren Giddings case was still making headlines in 2025. Learn more at https://www.13wmaz.com/article/news/local/macon/family-of-murdered-mercer-law-student-lauren-gidding-renew-search-body/93-9fda7367-e568-4c50-924e-8f4d1148631d

We explore the need for human expertise in solving cybercrimes. We discuss forensic tool limitations, examiner competence, and evolving technology challenges in digital evidence analysis. We'll also share insights on effective forensic methodologies and discuss the strengths and weaknesses of tools in real cases we've worked. Please join Stacy Eldridge and Becky Passmore for this episode of Parsing the Truth: One Byte at a Time.Digital Forensics Tools and Software Mentioned:AxiomSQLite ViewerExcelCelebrite UFED ReaderAutopsyFex Forensic TakeawaysTools don't solve cases, people do.Digital forensic tools amplify expertise, not replace it.Understanding data structures is crucial for examiners.Networking and communication are key in digital forensics.Forensic tools are effective when data is stable and predictable.Examiner competence is critical for courtroom defensibility.Manual analysis provides precision, tool-assisted analysis offers feasibility.Forensic success depends on methodologies, not expensive tools.Tools assume metadata is intact, which isn't always the case.Expertise lives in the chair, not in the tool.Tools don't speak. People speak.

To find Ricky Saxton's murderer, Wayne Mitchell has to manually recover hundreds of tiny digital crumbs in an attempt to find video evidence of Ricky's murder. But here's the thing, Wayne was almost kept out of the loop. Find out how it all went down.Special Guest: Wayne Mitchell

We're sharing 12 must-know artifacts to get you through the holiday season AND any digital forensics case that might come your way. Cozy up with your favorite beverage and sing along.

What do the prosecution and defense say about all this digital evidence during their closing arguments in the mushroom murders? We're breaking it down along with some discussion on suppressed evidence from this case.This is Part 3 Only.Make sure to go back and listen to Parts 1 and 2 if you haven't done that yet.

In this episode, we travel to Australia to learn about the digital evidence in the Erin Patterson Case, AKA the Mushroom Murders. We discuss cell phone location records and browser history to see if they can reveal any clues about where those deadly mushrooms originated.