Karen Read murder trial: Digital expert testifies about ‘hos long’ search, O’Keefe’s phone data (2025)

Crime

Cellebrite expert Ian Whiffin walked jurors through one of the most contentious pieces of evidence in Karen Read’s case Monday.

By Abby Patkin

updated on April 28, 2025 | 6:35 PM

11 minutes to read

On the stand Monday:

• Andrew Rentschler, ARCCA Inc. (voir dire, jurors not present)
• Daniel Wolfe, ARCCA Inc. (voir dire, jurors not present)
• Ian Whiffin, Vienna, VA

5 p.m. update: Crash expert faces sharp questioning with jurors absent

With jurors gone for the day, special prosecutor Hank Brennan had a crash reconstructionist from ARCCA Inc. in the hot seat for a testy, rapid-fire line of questioning.

The lengthy exchange with Daniel Wolfe was occasionally punctuated by raised voices and pointed jabs from Brennan, prompting Karen Read’s defense to raise frequent objections. Another ARCCA expert, Andrew Rentschler, followed Wolfe on the stand for a briefer and more subdued line of questioning.

Judge Beverly Cannone previously found Read’s lawyers made “repeated misrepresentations” to the court regarding the ARCCA experts. She also cited a “flagrant violation” of the defense team’s Rule 14 obligations for sharing pretrial discovery concerning the engineering consulting firm.

First hired by federal authorities to look into John O’Keefe’s death, Wolfe and Rentschler testified during Read’s first trial that O’Keefe’s fatal head injuries weren’t consistent with getting struck by a car and that damage to Read’s SUV was inconsistent with hitting O’Keefe. Read’s lawyers previously indicated the ARCCA witnesses were working independently and hadn’t been paid by the defense, though they later admitted to paying the experts nearly $24,000 following Read’s mistrial last year.

The defense officially retained ARCCA on March 26, 2025, after receiving authorization from federal authorities just days before jury selection in Read’s retrial was set to begin.

Cannone last week ordered ARCCA to provide certain records regarding its work and compensation in connection with Read’s case. Wolfe testified Monday he provided everything he had in his possession. He discussed at length his communication with Read’s defense, which began in March 2024 and spanned calls, emails, texts, and at least one video call.

Wolfe said Read’s case is a “very abnormal situation for (him),” between the secretive federal probe and two state murder trials. He said when he first spoke with defense attorney Alan Jackson in 2024, there was still a lot of uncertainty surrounding whether the ARCCA witnesses would even be allowed to testify.

Wolfe acknowledged speaking with Jackson about ARCCA’s typical procedures when consulting on a criminal defense, including potential compensation. Responding to later questions from defense attorney Robert Alessi, however, he said that following the initial conversation with Jackson, there was no understanding the defense would pay ARCCA for its work. He also noted he’s a salaried employee and doesn’t receive direct compensation when ARCCA sends out an invoice.

Wolfe testified that he didn’t know ARCCA had sent an invoice to Read’s team, or that the defense had paid it.

He confirmed he deleted his texts with Jackson following Read’s first trial, adding, “That’s something I routinely do.” He also testified he later communicated with Jackson via the encrypted messaging app Signal, as Jackson had indicated it was his preferred method of communication. Wolfe said he had no records in his possession of the Signal communications, which he said did not occur until earlier this year.

Brennan grilled Wolfe on an outline of questions and answers he sent Jackson before his testimony last year, and Wolfe said Jackson did not request the potential lines of inquiry, nor did they discuss them. He described the outline as something he does routinely when preparing to testify in a trial.

“You were making suggestions to help the defense, weren’t you?” Brennan demanded.

But, Wolfe testified that his outline was only intended to help the jury better understand ARCCA’s findings, adding he would have sent the same outline to prosecutors had they requested it. Answering Alessi’s questions later, Wolfe denied trying to favor the defense during Read’s first trial.

“Did the defense ever try to get you to improve or change any aspect of the report you had issued to the Department of Justice?” Alessi asked, earning a “no” from Wolfe.

Wolfe testified he received “a significant amount of harassment” online earlier this year after prosecutors filed a pretrial motion regarding ARCCA, adding that his wife and children were caught in the crossfire. He said he received several emails insinuating that he had perjured himself on the stand, “and a lot of hateful comments just about me and the work that I do.”

Alessi asked Wolfe if he believes he’s ever made an untruthful statement in Read’s case. Wolfe denied doing so.

Taking the stand at the end of the day, Rentschler spoke briefly about his own limited communication with the defense and said he only remembered discussing his background and qualifications ahead of his testimony last year.

Fielding a question from Brennan, Rentschler confirmed he ate lunch with the defense team following his 2024 testimony. Brennan asked Rentschler whether he spent time with Read and her family during that lunch.

“They were certainly there,” Rentschler replied, confirming Read and her family spoke to him.

ARCCA’s testing is complete, with an analysis and report to follow likely by May 7, according to the crash reconstructionists.

1:30 p.m. update: O’Keefe’s phone ‘never moved far away from the flagpole’ outside 34 Fairview, expert says

The three flights of stairs logged on John O’Keefe’s cellphone the morning of Jan. 29, 2022, were likely not triggered by O’Keefe actually climbing stairs, but by a change in altitude as he traveled in a moving vehicle, Cellebrite expert Ian Whiffin opined.

Citing the phone’s location at the time and his own testing, Whiffin testified, “I believe it is more likely that the device was in a vehicle, traveling on a road, going up an incline, versus the location data being incorrect and the person … walking up physical stairs.”

O’Keefe’s phone logged dozens of steps and three flights of stairs shortly before 12:30 a.m. on Jan. 29, even though location data showed the device still in transit, according to Whiffin. The phone began navigating via Waze at 12:19 a.m. and arrived in front of 34 Fairview Road around 12:24 a.m., he noted.

The 36 steps logged at about 12:32 a.m. were the last Apple Health activity the device recorded until shortly after 6 a.m., Whiffin testified. He said his testing found a 15-50 second delay on average between when an iPhone stopped moving and when it recorded the movement.

Defense digital expert Richard Green testified during Read’s first trial that O’Keefe’s phone showed three different timestamps for the same data, with those times varying by as much as three minutes. Addressing those “three clocks” Monday, Whiffin said he believes the confusion stems from the way one digital forensics software program displays power log data showing monotonic, baseband, and display time.

“As an examiner, it would be really bad to look at these values and think that they are accurate timestamps at face value, because they aren’t,” he added.

According to Whiffin, the temperature of O’Keefe’s phone battery steadily declined following his arrival at 34 Fairview Road, registering just 50 degrees Fahrenheit by 1:36 a.m. By comparison, the battery hovered around 80 degrees the night of Jan. 28 and clocked in at 77 degrees as O’Keefe was en route to Fairview Road.

As for device usage, Whiffin testified O’Keefe’s phone was unlocked and locked again a final time at 12:32 a.m., with no further activity until shortly after 6 a.m. He said the phone registered a “pocket state” where its camera was obscured for a period of more than five hours beginning around 12:33 a.m.

Special prosecutor Hank Brennan asked Whiffin for his opinion on the phone’s whereabouts after it first appeared near the flagpole outside 34 Fairview Road. Whiffin pointed to the phone’s location data, the hourslong “pocket state,” the lack of Apple Health data after 12:32 a.m., and the battery temperatures, which he said indicated the phone never moved to a warmer location.

“Based on the totality of all of the information that we’ve described, my opinion is that the device never moved far away from the flagpole,” Whiffin testified.

Defense attorney Robert Alessi had just begun his cross-examination when Judge Beverly Cannone dismissed jurors for the day and called a lunch break. During his questioning, however, Alessi pored over Whiffin’s timeline of O’Keefe’s phone activity, asking whether phone data “when correct and correctly analyzed” could help tell a story. Whiffin said it could.

Alessi also asked whether it was possible for anyone other than O’Keefe to unlock the phone using Face ID. Whiffin said it would have been possible, though he never checked to see if anyone other than O’Keefe had been registered for Face ID on the device.

A voir dire hearing with two crash reconstructionists from ARCCA Inc. will be held Monday afternoon without jurors present. Whiffin is expected back on the stand Tuesday.

11:15 a.m. update: Cellebrite expert explains infamous ‘hos long’ Google search

Jennifer McCabe did not Google “hos long to die in cold” at 2:27 a.m. on Jan. 29, 2022, Cellebrite expert Ian Whiffin testified Monday, offering jurors a closer look at one of the most contentious pieces of evidence in Karen Read’s case.

Whiffin, whose company specializes in digital forensics software, walked jurors through the now-infamous Google search and other data gleaned from McCabe’s cellphone.

The timing of the “hos long” search has been hotly disputed, with Read’s lawyers alleging McCabe had hypothermia on her mind hours before John O’Keefe was found unresponsive in the snow. McCabe maintains she made the search at Read’s insistence after she, Read, and Kerry Roberts found O’Keefe around 6 a.m. on Jan. 29.

According to Whiffin, McCabe’s phone data indicates searches for “how long ti die in cikd” and “hos long to die in cold” at 6:23 a.m. and 6:24 a.m., respectively.

Whiffin testified that defense digital expert Richard Green reached out to Cellebrite earlier in Read’s case to check the accuracy of the 2:27 a.m. timestamp. He opined that the timestamp actually indicates when the Safari tab McCabe used was “brought into focus” and said he reached out to Green to clarify but never received a response.

Whiffin testified that software in the digital forensics field is ever-evolving and explained that experts must stay on top of those changes to understand how they may impact data interpretation. He told jurors he’s created several digital forensics tools himself.

While software can produce a report on what a device’s data indicates, Whiffin maintained it’s a digital forensic examiner’s job to understand the data and put it in context, “rather than just taking it at face value.”

He added: “The examiner can and should go beyond what the data provides.”

Whiffin spoke about McCabe’s internet activity from around 2:27 a.m. on the 29th, noting she opened a Safari tab and used it to pull up several youth sports websites. The two hypothermia-related searches came hours later, he opined.

Whiffin said he believes neither search was logged in the phone’s history database because they didn’t finish loading. While using private browsing mode might also account for the absence, Whiffin testified McCabe wasn’t doing so.

There were no missing records in the phone’s history database, suggesting nothing was deleted there, he explained. Further, Whiffin noted that if an entry is never created in the history database, it wouldn’t be accessible for user deletion.

Whiffin then turned his attention to O’Keefe’s phone data, particularly the location and Apple Health data tracking movement.

Read’s lawyers contend O’Keefe’s phone data shows him taking 80 steps and climbing three flights of stairs after arriving at 34 Fairview Road, arguing the data suggests he entered the home. Whiffin said he conducted testing to see if an iPhone would log steps in a moving vehicle and testified that the device recorded some movement when he held it while driving.

Whiffin also testified about the location data tracking O’Keefe’s arrival at 34 Fairview Road. Special prosecutor Hank Brennan asked if a snowstorm or blizzard could impact the precision of a phone’s location information.

“It definitely has the potential to, yes,” Whiffin testified. He confirmed that the precision could also be impacted if the phone were covered or inside a building, or if someone were lying on top of it, as O’Keefe allegedly was.

Jurors were shown an aerial image with several points indicating the location of O’Keefe’s phone in front of 34 Fairview Road.

“Are all these dots and all these readings of the high frequency data that you’ve compiled for that night, are they all consistent with Mr. O’Keefe’s phone being near the flagpole and not moving that night?” Brennan asked.

“I think that’s a reasonable assumption,” Whiffin testified.

Judge Beverly Cannone called a mid-morning recess around 11 a.m. Whiffin will return to the stand when court is back in session.

Livestream via Court TV.

More witnesses are expected on the stand Monday as Karen Read stands trial again in the death of her boyfriend, Boston Police Officer John O’Keefe.

Jurors will have a half day in court, as a voir dire hearing is expected in the afternoon to vet two crash reconstructionists from ARCCA Inc. Daniel Wolfe and Andrew Rentschler previously testified for Read’s defense, opining that O’Keefe’s fatal head injuries weren’t consistent with getting hit by a car, contrary to prosecutors’ version of events.

Read, 45, is accused of drunkenly and deliberately backing her SUV into O’Keefe while dropping him off at a house party in Canton early on Jan. 29, 2022. But while prosecutors allege Read left O’Keefe to die in the snow, her lawyers claim she was framed in a widespread law enforcement coverup. They contend O’Keefe was actually beaten inside the home, attacked by the homeowner’s dog, and ultimately dumped outside in the snow.

Read’s first trial ended with a mistrial last July after jurors returned deadlocked. Her second trial began last week.