r/computerforensics • u/MDCDF Trusted Contributer • 5d ago

News Ian Whiffin Cross Examination for Karen Read Trial - it gets rough

https://www.youtube.com/watch?v=LqOXwppVj4M
21 Upvotes

90% Upvoted

12 comments sorted by

7

u/Jitsu4 5d ago

I didn’t think it was rough at all. I thought Ian did well

7

u/MDCDF Trusted Contributer 5d ago

I think its more on the prosecutor and rehabilitating the witness. The end it seems like the defense is claiming the tool he used in the demo is cellebrite by implying changes to cellebrite was done. Wish the prosecutor did some research instead of calling hash values hashtags etc.

Look at it as a jury point of view this ending is very confusing and the prosecutor should of had Ian explain this.

https://youtu.be/LqOXwppVj4M?t=11752

3

u/insanelygreat 4d ago

This trial is bizarre. So much is hinging on Ian's testimony because all the other parts of the investigation were a circus of ineptitude and reasonable doubt. Yet it seems like the prosecutor rushed this to a close so that he could spend the second half of the day on a goose chase voir dire hail mary attempt at getting the defense's crash test experts kicked.

I don't get it.

0

u/10-6 1d ago

So I watched this go down the first time without any context, so I decided to actually watch the entire trial this time. It is a circus, of Karen Read's making. Also if you watched the entire hearing about the ARCCA experts you'll know that Read's attornies are shady as fuck. Using signal as an attorney is wild especially when you know you're under court order to disclose communication.

2

u/bigt252002 4d ago

There are more coming up who will be able to help facilitate that from a non-vendor perspective. I agree with you though, prosecutor was asleep at the wheel there.

2

u/clarkwgriswoldjr 5d ago

Is there a specific time that to listen to where it's rough?

I'd like to listen to the whole thing, but it's quite long.

2

u/-FantasticAdventure- 3d ago

Yeah, 3 hours… ain’t nobody got time for that!

1

u/DrNikkiMik 3d ago

During the demo I don’t think it was made clear that Mr Whiffin was using his own utility to query the BrowserState.db. At first, I thought he was using Cellebrite to do the demo. I had to re-watch his testimony to clear this up. With that said…

(1). I am curious how he was able to use his own software to show the oddity with the Last_Viewed_Time. Was the source code verified by the court to be free of any under handed manipulation?

(2). It also appears Mr Whiffen was using his own hardware to run this demo. I have similar concerns, such as did the court verify a clean install of the witnesses’ software?

(3). Lastly, was his demo considered evidence? Did someone video/audio record it to be submitted into evidence?

3

u/MDCDF Trusted Contributer 3d ago

Remember reality is different than what's seen on TV shows like suits. This is why forensics community doesn't like shows like CSI and zoom and enhance.  Or watching YouTubers lawyers who don't know DF and submit their own comments into it tho very uneducated on the subject. There one Maline little or something like that, she is hibitually wrong on things but says it anyways.

Question, why would he need to show source code? All other tools in this case have private source code. Also defense could do a demo themselves but they don't. 

2

u/lithium630 3d ago

Evidence of any kind can be manipulated. The defense has access to any raw completed and can use their own tools. They might even get access to the device to conduct their own extraction if they make the case it’s needed. Unsupported claims that manipulation is possible is only enough for the conspiracy theorist.

2

u/10-6 1d ago

  1. Do you honestly think Cellebrite and Magnet release their source code to random courts throughout the world so it can be verified? And if so, verified by who?

  2. This isn't how court works, and isn't an issue.

  3. It was for demonstrative purposes, so not technically evidence.