Canton Cover-Up Part 249: Cellebrite Expert For Commonwealth Published Blog About Test He Conducted Proving Jennifer McCabe’s 2:27 Google Search Was Legitimate
Donate to the Turtleboy Legal defense fund
– Framed – Video for Full Background on Canton Cover-Up Story
– Donate to the Karen Read Legal Defense Fund
– See all parts of the Canton Cover-Up Series
– Watch the Live Shows and Videos
– Join ”Justice for John O’Keefe and Karen Read” FB Group
This is Ian Whiffin, the Senior Digital Intelligence Expert and Decoding Product Manager at Cellebrite.
Cellebrite is software used to extract data from phones, and is the industry standard for police and prosectors across the country. Prior to Karen Read’s expert Richard Green using Cellebrite to find Jennifer McCabe’s deleted 2:27 Google search for “hos long to die in cold,” its findings had never been questioned by law enforcement. Now they no longer accept Cellebrite reports because they don’t like how it inculpates Jennifer McCabe and exculpates Karen Read.
Whiffin has been retained by the Commonwealth as an expert in the Karen Read case, and submitted a forensic examination report into evidence.
We can’t read that report yet, but Mr. Whiffin does have a blog he published on November 24 that was pretty revealing. It’s noteworthy that his report was entered into evidence on November 7, but the blog he wrote was not published until November 24. This likely means that he was curious about what time Google searches are entered into the database and wanted to run his own test.
The blog explains how Whiffin conducted a test using an iOS 14, 15, and 16, to see if time stamps for Google searches are accurate in the database. The blog will give you a popsicle headache if you’re not into nerd talk, but it appears to prove that Jennifer McCabe’s 2:27 AM Google search is in fact legitimate.
Whiffin opened a Safari tab and did a search at 13:38 (military time), but it didn’t show up in the database. He did the same again at 13:39 with the same result. At 13:40 he opened a new tab and searched for 1340 and still nothing showed up in the database. At 13:41 he went back to the original tab and still nothing showed up in the database. Then at 13:42 he closed the original tab and it showed up in the database.
At 13:44 he did a search for 1344 in the only tab he had open (the second one he had previously opened at 13:40), but it didn’t show up in the database. He reloaded the page and it changed nothing. He then tried closing the second tab at 13:45, which left no tabs open. When you do that Safari automatically gives you a new tab:
By deleting the second tab the search for 1344 showed up in the database. At 13:47 he used the third tab (that automatically opened) and searched for 1347. He then minimized that Safari tab, then maximized it (brought it back up), and used it to search for 1350 at 13:50. He then closed the third tab, which once again registered it to the database.
The third tab’s last viewed time stamp was 13:45 (right as it turned to 13:46), which was the exact time Safari created a new tab for him after he closed the second tab. At 13:54 he searched for 1354, then closed Safari altogether at 13:55. He reopened Safari at 13:56, then closed the only open tab at 13:57.
As usual, closing the tab registered it to the database, with the last viewed time registered as 13:56.
The big takeaway here is that when you close a Safari tab it will register to the database for the last time it was viewed.
Jennifer McCabe used iOS 15, and Cellebrite says that she searched for “hos long to die in cold” at 2:27 AM.
This means that she either minimized or closed the tab at 2:27, but could have searched for that a few minutes before. The 2:27 time stamp indicates the last time it was viewed at that time, and this would not register in the database until she closed the tab completely. She then deleted her Google search completely, realizing what a mistake she had just made.
Her plan was to search for “hos long to die in cold” after John’s body was discovered, because it would make more sense and be less suspicious if she did it then. This meant that she couldn’t go to bed, which is why her Apple health data shows her pacing around her house until 4:53 AM when Karen Read called.
But what if Karen Read didn’t call her? It doesn’t matter. McCabe would still find out about John being found on the lawn rather quickly, and could still plausibly explain why she would make the search after his body was discovered. She could tell police that she was curious if her friend had a shot at surviving the cold without being at Fairview Road when the body was discovered.
However, Jennifer McCabe also knew that Karen knew that John O’Keefe was specifically invited to 34 Fairview Road by McCabe. Logically she would be the first person Karen Read called to ask what happened to John, since Karen knew that John went inside the house and that Jen would have seen him.
McCabe, Kerry Roberts, and Read arrived at 34 Fairview Road at 6:03 after Jen delayed as long as she could. She calmly remained in the vehicle and called 911 as Karen attempted to save his life. She made no attempt to go inside the house, or even alert the dispatcher that the “man laying in the snow” was her friend John O’Keefe, or that she was outside her sister’s house filled with warm blankets, or that her sister’s husband was a veteran first responder.
Then, remarkably, during the chaos and trauma of Karen Read screaming out for help, Jennifer McCabe told police that Karen Read instructed her to Google “how long to die in cold.” Her plan was to Google it the same way she misspelled it at 2:27, hoping that this would override her 2:27 search to the database. Unfortunately she Googled the Apple suggested search “how long does it take to digest food” as she began her search. She quickly did another search but once again spelled the misspelling wrong when she searched for “how long ti die in clkd” at 6:23. Finally, she used that same tab to Google “hos long to die in cold” seconds later.
According to Whiffin’s research, which he conducted AFTER being named as an expert Cellebrite witness for the Commonwealth, Jennifer McCabe’s 2:27 search was legitimate, because she last viewed that tab at 2:27 AM. This officially closes the door on the Commonwealth’s lie that McCabe opened a tab that at 6:23 that she had used to view Ozone basketball at 2:27 AM, and Googled “hos long to die in cold,” which they claim is the reason it registered at 2:27 AM. The tab that was last viewed at 2:27 specifically said “hos long to die in cold,” not “Ozone basketball.”
I anxiously await the Commonwealth’s fourth forensic expert to be added as a witness after they discover what Whiffin will testify to at trial.
I am somewhat tech savvy but I got alil confused with this open that closed etc. I’m assuming this was (besides Higgins flipping) something that helped the feds realize what was happening. They have know since last Dec. They have more information than the defense an commonwealth combined. It’s gonna be a glorious day seeing all them in the Court House Penalty Box
It’s saying if anything, a search can show up in the log at a later time but will not show up as an earlier timestamp. So the search is only logged when closed. So if the search was closed at 2:27am on Jen’s phone it actually happened earlier than 2:27, not later.
Exactly.
Say it louder for the people in the back!
“This officially closes the door on the Commonwealth’s lie that McCabe opened a tab that at 6:23 that she had used to view Ozone basketball at 2:27 AM, and Googled “hos long to die in cold,” which they claim is the reason it registered at 2:27 AM. The tab that was last viewed at 2:27 specifically said “hos long to die in cold,” not “Ozone basketball.””
This also replenishes hope that not only will Karen be exonerated, but that a proper investigation into John’s death will begin and that justice will be served.
You are doing GOD’S WORK, AIDAN. May no weapon formed against you prosper. In Jesus’s name, we pray for you. XO
The idea that Karen would be in the middle of trying to save her boyfriend and telling someone to google anything is absurd.. Not believable and when a jury hears the recorded phone call that has been leaked it will only convince them further that not only did it not happen but that JM is an evil woman. If I were her I would be trying to work a deal because a jury will not like her.
That’s an excellent point. She’s a nightmare to put on the stand and her actions, as a woman and mother, are deplorable.
She has zero sympathetic angle to even give herself a slight edge.
Def should take any deal they offer. A blessing.
I’m mostly nauseated by the fact this is still going on … but watching them all dig themselves deeper holes takes the sting off, slightly.
***Sorry to the innocent lives ruined, it’s not a comment to take from that, at all.***
How has this case continued at all against Karen Read once the google search at 2:27am was discovered?
Because at this point they have no choice but to go forward and double down on their behavior.. Dropping charges now is an admission by the troopers, DA, CPD that they compromised an investigation and intentionally. If they drop it now there will be thousands of people looking for justice for John and that involves charging those that they went out of their way to protect.
It’s crazy but they can’t quit now.. They will quit when they get hauled out in handcuffs.
Good answer. Also, all of Proctor’s previous cases will fall under suspicion now and the defense lawyers in those cases will be filing motions for retrial. It’ll be a bigger mess than the drug lab testing scandal. They HAVE to go all in, force her to spend money defending herself and when she’s acquitted, just throw up their hands and say “hey, we tried. She got off, she’s too smart for us”, etc.
They know they can financially smother any “random fucking citizen.” Exactly.
I say they’re flopping like fish out of water, and it’s utterly pathetic, at this point.
MSP needs to save face and bury these troopers. This is infinitely worse than the OT scandal.
The silence from the PD is unbelievable.
Today is the funeral of the Waltham officer killed … being run over from a car. Watch how this case plays out.
They want homicide on the man, instead of manslaughter. I believe they are likely correct, as I believe he banged a U-ey to run them down. They are searching for evidence to provide it was with intent.
I am keeping close watch of that investigation.
They can quit, now… but none of these individuals is strong enough, ethical enough, or bold enough to slowly fall all the way down that long sword…. It’d be too painful.
I wholeheartedly agree. They’re in too deep, and no one will cave.
IMO… it’s time for them to give it up.
It’s been time.
The sooner the better, no reason delaying the inevitable … but that is their hubris, they still think they’re untouchable. Silly Wabbits.
This is what Morrissey is desperately trying NOT to be forced to explain to the Feds, under oath.
He he… Meatball Moron.
He’s terrified.
McAlberts welcome to the rest of your mortal lives in a cage.
The average time served for murder in the US including life without parole and death penalty sentences is 18 years. None of the people involved even if convicted will do more than 6 years.
Jen must be making a river after reading this.
Commonwealth should call in Dr Irwin Corey. Maybe he can explain it.
Jen looks like skeletor in a swimsuit. Yikes!
She probably doesn’t sleep anymore or her fat fag husband is eating her meals.
Someone make that gal a steak dinner
Stop lying. I know that’s a big ask.
The blog in question shows that the timestamp of the searches are not accurate, and he shows numerous examples of searches seemingly taking place before they actually did.
His ACTUAL conclusion in the blog: “This is a great example of not only how these files can change over time, but how their use can change over time too. And that something that seems obvious, such as a field called “last_visited_timestamp” may be anything but.”
This is really good news for Jen McCabe, as the iOs version on her phone shows the most propensity for errors in recording the time of the search.
Now, about that unfortunate Scanlon reveal on last night’s show…LOL
Keep up the Dumb act with the information, your lies mean nothing. Jen ( Horse face) and Matt (bitch tits) will be looked at forever as Shit. People know the stink they hold from this, we don’t believe their lies. Horse Face loses much more weight she’s going to croak
Why are you here?
You’re wrong. He’s saying the timestamp indicates the time the page loads. So if the search was loaded at 2:27am it was searched prior to 2:27am, not after.
That behavior is described for iOS 14. For iOS 15 he shows he can cause time stamps that show earlier then when the event occurred. I am not suggesting this instantly means Karen Read can’t be innocent..just I don’t think we are reaching the correct conclusion from this data.
You have such a sad life… doesn’t seem to have a purpose and you are filled with anger, hatred, obsession, and jealousy..
It must suck to be you.
Not as badly as it sucks to be Aidan Kearney, that’s for sure!
See there you go again. So focused on someone else. Worry about yourself and work on YOU. It’s not a meaningful life if you spend it every day, all day long obsessed, angry, bitter, raging, etc. Get some help before you really crack.
That focus on you makes you really uncomfortable, doesn’t it Aidan? I dont blame you; the deeper people look at you the worse you appear. At the rate thing are going I can see the day when Kate is raising your kids for you.
We aren’t the jury. Save it for them.
I’m still waiting for all that blockbuster evidence the State keeps promising. You know, the evidence they have to turn over to the defense. Where is it? Why aren’t they turning over the evidence like dna and clothes? Oh, wait, because they know it’ll hurt their case.
Keep in mind, Jen didn’t go INTO the house for help, and no one in the house came OUT to help.
SO cut the crap. This is not how innocent people act. NO ONE who’s woken up with a crowd and cops and a poor guy’s body on their lawn, stays in the house. NO ONE.
No, he said the timestamp registers to the cellebrite data once the window is closed meaning the search had to happen at some point before 2:27am
No, he said the record is written to the database when the tab is closed, but the timestamp shows the time when the tab “came into focus” (I.e. when tab was originally opened, or when the tab was re-opened after fully closing safari).
Look at his search for 1350. He closed this tab at 1350, but the timestamp shows 1346, which is when the tab was opened, not when the tab was closed.
I’m a FKR guy and remain so, but this appears to work in favor of the CW.
It wouldn’t of registered at 227 for “hos long to” unless she had closed it at 227. Meaning it happened at or prior to 227. She then opened a new tab a 623 for how long to digest, closed that. Then opened again with the hos long and so on.
Here’s the issue. The 227 doesn’t refer to the time it “registered” in the file (which would be the update timestamp of the file itself). The 227 is from the timestamp column of the entry WITHIN the file (“last_viewed_time” column in the guy’s analysis — which is horribly named btw because he has shown it is not, in fact, the last viewed time).
Again, look at his example for 1350. The 1350 search “registers” in the file at 1350 when he closed the tab (meaning the timestamp of the FILE would be 1350). But the entry in the file for the 1350 search has a 1346 timestamp from when the tab was originally opened.
Every time McCabe closed a tab up until the time her phone was forensically copied, it would have updated the file timestamp with the latest time an entry was written to the file (notice when he closes a tab it does not create a new file but updates the existing one). So, the only way to prove the 227 search entry “registered” to the file at 227 would have been to get a copy of the BrowserState.db file immediately after 227 before any other Safari activity. Otherwise it’s plausible it could have been searched in the same tab several hours later. The problem is we don’t have a file from 227, we have a file from a much later date showing an entry with a timestamp of 227, which he has shown could be the time the tab was originally opened, before the search was done.
Regardless, the CW is going to have a hell of a time explaining this to a jury. And I still don’t think this completely exonerates JM.
Directly from the article “The big takeaway here is that when you close a Safari tab it will register to the database for the last time it was viewed.” The tab that Jen searched on was closed and therefore registered to the database at 2:27am meaning the search had to have been done before then. You can’t search on an already closed tab. If you go look at the chart, ID 4 is registered at 13:50 btw.
ID 4 is not the 13:50 search, it is the tab that gets created when he closes the 13:50 search (which is ID 3). “Tab 3’s last_viewed_timestamp was essentially the time that I’d closed the tab and Safari created me a new one.” He’s not talking about when he closed Tab 3, he’s talking about when he closed the prior tab, Tab 2, and Tab 3 got created automatically by Safari.
Bottom line: Tab 3, which was closed at 13:50, has a timestamp of 13:46, which was when it was opened.
Directly from the author:
“Firstly, and most importantly, the last_viewed_time does not necessarily relate to the URL that is shown. It is in fact time the tab took focus. This could mean taking focus from another tab, being generated as a new tab or loading Safari from closed.”
You’re so bitter! Mom and dad didn’t raise us this way. Christmas is going to be awful this year. You keep disgracing the Sharon name on here with your bonehead comments. Us Sharons are better than this!
This legit hurt my brain and I still don’t get it but seems pretty air tight
Agreed!
agreed 👍
You don’t get it but it seems airtight.
Looks like a certain former bartender who likes to wear his sunglasses at night might stand a chance as the CW’s 4th forensic tech expert. He can probably create a helpful video demo to accompany his analysis. He learned allllllll about analyzing cellphone data this summer on the interwebs, so he’s an expert now.
I am confused by the conclusion of this blog post, Sorry. I read Whiffin’s blog post carefully. I am a mobile iOS engineer by trade so I can usually parse through this stuff without getting too much popsicle brain. I didn’t digest every scenario, but according to the blog post under iOS 15 there are numerous examples of time stamps showing times that are in fact earlier than when the search events actually occurred. Wouldn’t this tend to support prosecution theory that the ‘hos long to die in cold?’ Search could have been made after its 2am timestamp?
I read the information and in layman’s terms it seems the expert (Whiffin) is saying a timestamp of a search is logged when the tab is closed so the timestamp for a search may be long after the time of the actual search but not earlier. So Mccabe did her search between midnight and 2:27am but not later – say at 6am.
I read that too for iOS 14, but under the iOS 15 tests there are numerous examples where the time stamps read earlier than when they occurred. This seems like the most important take away – that there is reproducible steps that show how this can occur.
That’s just what the data shows. I have been following this case and generally support turtle boys work, but we can’t expect anyone to take these theories seriously if we don’t back up with good interpretation of the evidence. Unless I am missing something else (it’s possible) I think he got this one wrong.
No, for the IOS 15 (which McCabe’s phone used) he states “note the creation time matches the time I closed the tab.” He states he conducted searches at 13:39 – 13:41. Those searches were not showing on the log until AFTER HE CLOSED THE TAB at 13:42, at which point, those searches were on the log at 13:42. That means, per his analysis, that if the “Hos long” search shows up in the log at 2:27 AM, then it means the tab was closed at 2:27 AM, therefore the “Hos long” search was conducted at or prior to 2:27 AM, and could not have been conducted later than 2:27 AM.
There are two times. The time when something shows up in the report, and the “last viewed” time. The former is created when the tab is closed. The latter is the time the tab was last viewed. That’s what I’m getting out of this.
So 2:27 is when the tab was last viewed. Do we know the time it shows up in the report? If that’s 2:27 also then I agree with you. If not, the CWs explanation is possible
People down voting this like it is some kind of attempt to tear down the entire case they bet their lives on. Absolute absurdity and half-wit behavior
Well said. And true. The ☝️commenter was asking an honest question in good faith.
Looks like Whiffin is in fact on the witness list for prosecution. This will be their argument for why 2:30 am search appeared in logs. Seems compelling, but wonder what the defense expert brings up.
ThiS expert just Learned how this browser works ?
Bridgewater State Grad ?
I’d like to hear his testimony under cross, because if you read this blog, he’s stating McCabe conducted her famous “hos long” search BEFORE 2:27AM, as it was registered when she closed the tab at that time. If that’s true, then McCabe is toast. No way around that evidence, especially with all the lies around it since it was discovered.
You really need to brush up on your reading comprehension skills, you big dummy.
What the blog ACTUALLY says is that searches made at a certain time can appear to be made at an earlier time, and he could easily recreate this. In short, it’s entirely possible and plausible that the 2:27 AM search was actually made around 6 am. Since the entire basis of the conspiracy revolves around the 2:27 AM search this means that KR’s defense is toast, not Jen McCabe.
Wrong. He clearly states “note the creation time matches the time I closed the tab.” His words. He conducted searches at 1339 – 1341. Those searches were not showing on the log until AFTER HE CLOSED THE TAB at 13:42, at which point, those searches were logged at 13:42. Again, “note the creation time matches the time I closed the tab.” That means, per his analysis, that if the “Hos long” search shows up in the log at 2:27 AM, the tab was closed at 2:27 AM, so the “Hos long” search was conducted at or prior to 2:27 AM. His words, not mine. You can try to argue the analysis and tech (good luck), but you can’t argue what he stated. His words.
Don’t waste your breath, this clown don’t care about foolish things like facts, or the exact words someone used, they only care about spreading lies in a desperate attempt to sway public opinion back in their favor!!
Wow you are so far off.. how is 6 am before 227 am.. are you ok?
Dumb twat should have used Duck Duck Go. No wonder she looks like she’s on meth. Guilt.
Hahahahahahahahahaha welp, that’s not what the Commonwealth wanted! Time for a 400th opinion …
Wow wonderful blog layout How long have you been blogging for you make blogging look easy The overall look of your site is great as well as the content
Of course like your website however you have to check the spelling on many of your posts. many of them are rife wih spelling issues and I find it very hard to inform the truth on the other hand I will likely come again again
I had a great time with that, too. Despite the high quality of the visuals and the prose, you find yourself eagerly anticipating what happens next. If you decide to defend this walk, it will basically be the same every time.
I just like the helpful information you provide in your articles
I enjoyed it just as much as you will be able to accomplish here. You should be apprehensive about providing the following, but the sketch is lovely and the writing is stylish; yet, you should definitely return back as you will be doing this walk so frequently.
Can you be more specific about the content of your article? After reading it, I still have some doubts. Hope you can help me.
Okay, can we stop this right now? This test doesn’t prove anything at all…
Why do I say that? Because she deleted the record and data recovery on such devices has been shown to actually merge records when recovered, making them unreliable.
They need the DNS and Search Provider history from the servers to prove this was at 2:27.
Do I believe the search was at 2:27? Yes I do, but the fact that it was a recovered file makes it somewhat ambiguous and it doesn’t matter how many tests he made on his own device as it is a variable you simply cannot recreate.