A tab timestamp is not necessarily a search timestamp
Whiffin’s published testing distinguishes two parts of Safari’s saved tab information: the time associated with bringing a tab into focus, and the address and title of its most recent page. The latter can change without the former changing. When and how that information is written also depends on the iOS version.
A simple example
Illustrative times, not McCabe’s phone data:
- At 10:00, a person opens a tab and searches for the weather.
- At 10:05, they search for a recipe in that same focused tab.
- The saved tab information can pair the 10:00 timestamp with the later recipe address.
Reading that pair as “recipe searched at 10:00” would confuse two different events.
This explains how an earlier time can appear beside a later search. It does not, by itself, establish what happened on McCabe’s phone.
Why did Hyde place the search at 6:24 a.m.?
Hyde described morning traces in both MobileSafari preferences and Apple’s KnowledgeC database: an earlier misspelled query around 6:23, followed by the disputed “hos long to die in cold” query around 6:24. She interpreted the tab record as retaining the later query alongside an older timestamp.
The important question is whether records that track search activity support the time inferred from a saved tab. Several traces of one action can help interpret it; they should not be counted as several independent searches.
Why did AXIOM and Cellebrite look different?
The earlier time remained visible
On recross in the retrial, Whiffin agreed AXIOM still displayed 2:27 a.m. He described its field as a tab-interaction time.
The misleading time interpretation was removed
Whiffin said Cellebrite removed the timestamp after research showed it did not reliably identify when the page was last visited.
These are descriptions of the software discussed at trial, not a review of today’s versions. A program displaying 2:27 does not settle what that time represents. Conversely, removing a field from a report does not prove the underlying data disappeared or establish a later search time.
Open the full software comparison, manual references and testimony locators. We do not claim that both programs produced identical 6:24 a.m. report screens.
Was the search manually deleted?
Hyde’s opinion was that the disputed artifact was not user-deleted. She explained that recovery from a write-ahead log, AXIOM’s “carved” description and Cellebrite’s recovery indicator required examination of the data; those labels alone did not establish a person had deleted it.
That is a finding about this artifact. It should not become a blanket claim that nothing else on the phone was deleted.
The opposing interpretation deserves a clear account
At the 2024 trial, Green maintained that the query occurred at or before 2:27 a.m. and was in a deleted state. He relied on the write-ahead log, the phone’s operating system and comparisons with its other data. He rejected the suggestion that the disputed record simply represented the later 6:24 search. His position was more than an objection to a confusing software label.
There is also an important qualification in Hyde’s own work. During the 2025 retrial, cross-examination drew attention to her report acknowledging that the definitive reason for the precise 2:27:40 timestamp was unknown. She maintained her morning-search conclusion. We should therefore distinguish a demonstrated reason not to equate tab time with search time from a complete explanation of every value on this particular phone.
The two trial years matter: Green’s account above is from the first trial; the cited Hyde and Whiffin examinations are from the retrial. Combining them without dates can make separate proceedings sound like one exchange.
Why we give the morning explanation more weight
A time printed beside a phrase is compelling only if that field actually dates the action being alleged. We give greater weight to the explanation that addresses both the tab’s behavior and the morning search traces. On that basis, we do not regard the disputed artifact as persuasive evidence that McCabe searched about dying in the cold before John was found.
This conclusion does not establish how John died, prove a vehicle strike or resolve every allegation about the investigation. Our belief that Read struck him comes from our assessment of the wider evidence and its strongest objections, not from treating a rejected search theory as proof of guilt.
Read was acquitted of the death-related charges and convicted of operating under the influence. The verdict is distinct from our interpretation.
