Experts disagreed over the meaning of a 2:27 a.m. artifact associated with a later cold-survival search.
What the record shows
Green's first-trial interpretation supported an earlier search. Hyde's retrial analysis attributed the earlier time to browser activity and placed the relevant searches after the morning discovery.
The linked 2024 exhibit packet contains browser-artifact tables and explanatory slides, not a message conversation. It provides earlier documentary context for this timestamp dispute. Database labels, browser state and timezone columns must be interpreted with the expert testimony; a row is not automatically a distinct search made at that time.
Key facts
- Disputed artifact
- 2:27 a.m.
- Later search interpretation
- 6:24 a.m. (Hyde and Whiffin)
- Current software status
- Not established here
- Deletion interpretation
- No user deletion of this search (Hyde)
Limits and disputed context
A database value, a software display label, and a search-execution time are not interchangeable. This entry makes no claim about the current behavior of AXIOM or Cellebrite software.
The Google search: 6:24 a.m. or 2:27 a.m.?
Jennifer McCabe's search, the Safari tab timestamp and the deletion dispute.
Why we give this weight
Hyde and Whiffin placed the Google search, "hos long to die in cold," at 6:24 a.m. Their explanation is that a browser-tab record can pair an earlier tab time with the last page used in that tab. Whiffin's tests show that this time relates to when the tab took focus. It is not necessarily the time the search was typed. That is why they did not read 2:27 a.m. as the time of this query.
Hyde also testified that McCabe did not manually delete this search. She explained that a temporary database log can hold records as the phone updates its data. Finding a search there, or seeing it labeled "deleted" by forensic software, does not by itself show that someone deliberately erased it.
The material challenge
Green's first-trial analysis placed the search at or before 2:27 a.m. and described the artifact as deleted. He disagreed that it was the same search recorded at 6:24 a.m.
On cross-examination, Hyde acknowledged her report did not identify a definitive reason for that artifact's precise 2:27:40 timestamp.
Our response
We find the later-search explanation more convincing because it accounts for the browser's behavior and the other traces of the search, rather than relying on one timestamp. That supports our reading of this search; it does not tell us how John died.
What we are not claiming
The no-manual-deletion statement is Hyde's conclusion about this search, not a finding that McCabe never deleted other information. We have not independently examined the phone extraction.
Claims connected to this record
We examine defense arguments and broader inferences separately. Each heading is a paraphrase of the proposition being tested, not a quotation or a finding. The source account comes first; our reasoning is labeled. Missing evidence is not automatically evidence that an event could not happen.
These claim assessments cover the criminal trials through June 18, 2025. Later proceedings are covered separately in After the Verdict. These are selected assessments, not an exhaustive trial record. Most sources are trial reporting; a passage check does not authenticate original evidence. Several reports may describe the same testimony, and measurements from one phone are not independent witnesses. Rejecting a proposed cover-up mechanism does not establish a collision or guilt.
The 2:27 a.m. timestamp establishes an early cold-survival search
Defense expert interpretation at the first trial; disputed by retrial experts. Paraphrase, not a quotation.
Why the claim is raised
Green placed the query at or before 2:27 a.m. Hyde and Whiffin disagreed with that reading.
Strongest evidence or missing support
Hyde and Whiffin placed the search at 6:24 a.m. Whiffin's tests demonstrate an older tab-focus time paired with a later page URL.
Our reasoning
We give the explanation of the artifact's behavior more weight than reading its timestamp as the search time without that context.
Limits and strongest remaining objection
Hyde could not definitively explain the precise 2:27:40 value in her report. We have not independently examined the extraction; Green's disagreement remains part of the record.
A deleted label means McCabe manually erased this search
Disputed forensic interpretation associated with the search artifact; not a claim about every deletion on the phone.
Why the claim is raised
Green characterized the artifact as deleted in the first trial.
Strongest evidence or missing support
Hyde testified that this search was not manually deleted. Temporary database records and forensic software labels do not by themselves establish a user's action.
Our reasoning
We do not treat a software label as proof of deliberate concealment. The examiner must establish what produced that artifact.
Limits and strongest remaining objection
This assessment concerns this search only. It does not establish that no messages, calls or other information were deleted.
S13: Hyde: interpretation of the disputed Safari artifact
5 p.m. update; Hyde cross-examination and device handling
Open publisher sourceS23: Green's first-trial interpretation of the search timestamp
Richard Green testimony
Open publisher sourceS48: 2024 browser-artifact tables and explanatory slides: exhibits 614-626
13-page PDF; browser-history/search-artifact tables and explanations, particularly pages 1-9.
Open publisher sourceS19: Whiffin phone-data cross-examination and McCabe testimony
April 29, 2025: 1 p.m. Whiffin cross-examination and redirect; 2:20 p.m. location-accuracy discussion.
Open publisher sourceS52: BrowserState.db last_viewed_time? (Again)
Revised September 9, 2024; iOS15 and above tests, Tab Focus and Scenarios.
Open publisher source