MA v. Lindsay Clancy Day 14

Bailiff (00:02):

This court is now in session. Please be seated.

Clerk (00:04):

Good morning, Your Honor. May I proceed?

Judge William Sullivan (00:05):

Yes, please.

Clerk (00:06):

Your Honor, before the court today, we have the matter of Commonwealth versus Lindsay Clancy. Ms. Clancy is present. She is represented by attorney Kevin Reddington and the Commonwealth is represented by Assistant District Attorney Jennifer Sprague and Assistant District Attorney Shannon Buckingham.

Judge William Sullivan (00:12):

All right. Well, good morning everyone. Good morning, counsel.

Jennifer Sprague (00:12):

Morning.

Judge William Sullivan (00:12):

Good morning, Ms. Clancy.

Lindsay Clancy (00:12):

Morning, Your Honor.

Judge William Sullivan (00:12):

All right. Before we bring the jury in, could I see everybody just for a few seconds?

Crew (00:12):

Camera speed.

Bailiff (00:12):

All rise, please. Hear ye, hear ye, hear ye, all persons having anything to do before the Honorable William Sullivan, Justice of the Superior Court now sitting in Plymouth within and for the Commonwealth of Massachusetts, this court is now in session. Please be seated.

Clerk (00:12):

Good morning, Your Honor. May I proceed?

Judge William Sullivan (00:12):

Please.

Clerk (00:12):

Your Honor, before the court today, we have the continuation of the jury trial in the matter of Commonwealth versus Lindsay Clancy. Ms. Clancy is present. She is represented by attorney Kevin Reddington. The Commonwealth is represented by Assistant District Attorney Jennifer Sprague and Assistant District Attorney Shannon Buckingham.

Judge William Sullivan (00:20):

Well, good morning everyone.

Courtroom (00:21):

Good morning.

Judge William Sullivan (03:04):

Nice to see everyone. I hope everybody had a chance to kind of rest up a little bit and come back here and we're going to get right back to the trial. So what I want to do first, ask you those questions since we had a long break, and then talk a little bit about the schedule and today's schedule and kind of where we go from here. So first question, as you know, has any member of the jury read, seen, heard, or overheard anything from any source about any aspect of this case that would affect your ability to be a fair and impartial juror?

Jury (03:40):

No, Your Honor.

Judge William Sullivan (03:40):

All right. Next question. Is there any other serious matter or concern bearing on your service as a juror in this case that anybody needs to bring to my attention at this time?

Jury (03:47):

No, Your Honor.

Judge William Sullivan (03:48):

Again, thank you so much for following those instructions. So today's schedule is that it may be kind of a little bit stop and start. Okay? So kind of bear with us on that. Might be a couple times you got to take a break just after a short amount of time and then we'll bring you back in. It's just the nature of cases at this point. It's anticipated that the Commonwealth will close their portion of the evidence today. All right. Then at that point, the defendant has the opportunity, if they want to, to present witnesses and evidence if they want to. But remember, they don't have to. The burden of proof is always on the Commonwealth. If the defendant offers evidence, then the Commonwealth is then given the opportunity to offer rebuttal evidence. All right. And so that's kind of the next phase that we're about to go into after the Commonwealth rests. And I'll go into a little bit more kind of how that goes, but I just kind of wanted you to kind of see where we are and where everything's going to fit procedurally as we go forward from here.

(04:57)
So with that, we're going to return to the Commonwealth's case. And Attorney Sprague.

Jennifer Sprague (05:00):

Thank you, Your Honor. Commonwealth calls Ian Whiffin.

Clerk (05:29):

Good morning. Do you solemnly swear that the testimony of the evidence you shall give to the court and and the jury [inaudible 00:05:33] and nothing but the truth, so help you God?

Ian Whiffin (05:33):

I would rather affirm I do.

Clerk (05:33):

Thank you.

Ian Whiffin (05:33):

Thank you.

Judge William Sullivan (05:44):

All right. Good morning, sir.

Ian Whiffin (05:45):

Good morning.

Judge William Sullivan (05:46):

All right. Attorney Sprague, please.

Jennifer Sprague (05:48):

Thank you. Good morning. Can you please state and spell your name for the record?

Ian Whiffin (05:51):

Yes, it's Ian Whiffin. I-A-N W-H-I-F-F-I-N.

Jennifer Sprague (05:57):

Where do you work?

Ian Whiffin (05:58):

Cellebrite.

Jennifer Sprague (05:59):

What is Cellebrite?

Ian Whiffin (06:01):

Cellebrite is a digital intelligence company working in the digital forensics field.

Jennifer Sprague (06:06):

And how long have you worked there?

Ian Whiffin (06:08):

Since 2020.

Jennifer Sprague (06:11):

What is your role at Cellebrite?

Ian Whiffin (06:13):

I'm currently a customer engagement manager.

Jennifer Sprague (06:16):

What does that mean?

Ian Whiffin (06:17):

I work with customers helping users of our tools to understand the digital evidence that they're finding and presenting.

Jennifer Sprague (06:27):

And what does digital evidence consist of?

Ian Whiffin (06:30):

Any information which is extracted from a cell phone primarily, or from a computer, which can be interpreted by the examiner and presented as evidence. It could be call history, messages, location data, media, anything that you can find from a digital device.

Jennifer Sprague (06:47):

Could you just briefly describe your educational training background that qualifies you to do this work?

Ian Whiffin (06:53):

Yeah. I've worked in IT for many years. In 2013, I began my career within Calgary Police Service in Canada as a digital forensics examiner. That was after spending approximately 9 or 10 years working as a patrol officer in the UK and in Canada. As part of my role as a digital forensics examiner within the Calgary Police, I went on numerous training courses. The Canadian Police College, they did an introductory course into digital forensics, and then further courses focusing on mobile data provided by some vendors such as BlackLight or Cellebrite at the time, as well as further courses presented by the Canadian Police College, specifically about cell phones.

Jennifer Sprague (07:44):

And Cellebrite, the software produced by Cellebrite, is that software used to extract and analyze data from cell phones and computers?

Ian Whiffin (07:54):

Yes. There are several tools within our catalog. One of them is designed to extract as much data as possible from a cell phone. And then one of the other tools is designed to take that extracted data, decode it, decrypt it, make sense of it, and provide it to the user in a way which can be searched, filtered, organized, reported, and presented.

Jennifer Sprague (08:19):

Does Cellebrite's ability to access cell phone data continually change based on improvements that are done to the phones themselves?

Ian Whiffin (08:32):

Yes. There's constantly changes being made to devices which make it difficult to extract the data. There are changes being made to the software that means that the data that we extract is now different to the data that we extracted previously. A new feature, for example, or a change that's made by the software developer. So we're constantly changing our software to be able to extract that data and to decode more data.

Jennifer Sprague (08:59):

Were you asked to locate Apple Health data and other information that could be relevant to the investigation of an incident that occurred at 47 Summer Street in Duxbury on January 24th, 2023?

Ian Whiffin (09:13):

I was, yes.

Jennifer Sprague (09:14):

And what is Apple Health data?

Ian Whiffin (09:17):

Apple Health is a component of the iOS operating system which logs sensor data from multiple locations. So there's sensors built within an iPhone that monitor steps taken, flights climbed, for example, as well as third party devices, Apple watches, Fitbits, any other device. All the information is brought into the Apple Health application, aggregated, and made available for the user to see.

Jennifer Sprague (09:47):

Roughly how many phone extractions have you done?

Ian Whiffin (09:51):

Since around 2013, well over a thousand phones.

Jennifer Sprague (09:57):

And how many times have you done analysis on phone extractions?

Ian Whiffin (10:02):

The analysis is part and parcel. So of those thousand phones or so which I've extracted, I've done analysis on all of those phones as well.

Jennifer Sprague (10:09):

And then you've also done analysis on extractions like in this case where someone else did the extraction and provided the information to you and you did the analysis?

Ian Whiffin (10:19):

Correct. Yeah. Whenever I'm helping customers or users of our tools, they may provide me with the extracted data. So the data which I'm analyzing is more than the devices I've extracted.

Jennifer Sprague (10:32):

And have you testified previously in courts about what you've done in terms of extracting and analyzing information?

Ian Whiffin (10:39):

Yes, I've testified in multiple courts around the world approximately 28 times.

Jennifer Sprague (10:43):

Now you received a copy of the extraction for Lindsay Clancy's iPhone 13, correct?

Ian Whiffin (10:51):

Correct.

Jennifer Sprague (10:52):

And when you received that extraction, did you also want to know all the specific information about the case in the investigation?

Ian Whiffin (11:01):

Typically when I'm working a case, I don't want to know a lot of detail. I'd rather come to my own conclusions based on the data that I'm viewing rather than note the intricacies of the case. All I require is an outline, the date that something happened, the time, who was involved, basic information.

Jennifer Sprague (11:21):

And in terms of the extraction that was done on Lindsay Clancy's iPhone, that extraction, what type of extraction was it?

Ian Whiffin (11:30):

That's what's called a full file system extraction. It's essentially all of the data which has been extracted from the device that is still live.

Jennifer Sprague (11:39):

And did you use specific tools to conduct your analysis?

Ian Whiffin (11:43):

Yes. There's the Cellebrite physical analyzer tool created by Cellebrite and also my own tooling applications that I've been working on for several years.

Jennifer Sprague (11:53):

So you've actually made your own tools that allow you to examine phone extractions?

Ian Whiffin (11:58):

Correct. There's some tools that I've been working on since prior to joining Cellebrite. Tools that as an examiner I decided that I needed to create for myself and make available to others. And I still use those tools to this day.

Jennifer Sprague (12:14):

And these tools that you used, are those the tools that allow you to examine and categorize the information, the data that you find in the extraction?

Ian Whiffin (12:25):

Yes. The primary point of the tool is to go into the data, decode it, provide it in a way which is easy to filter and search, but also additional tools there that allow you to dig into the data and look at the raw information, the databases, the files, all of the raw information, which is what our tools initially decode.

Jennifer Sprague (12:49):

And did you focus in on a particular timeframe when looking at the data on the defendant's iPhone?

Ian Whiffin (12:58):

Primarily I knew that the date of the incident was 24th of January 2023. So that was the main focus of my analysis. But some of the data I was aware could be from further afield than that. So I took a look of, I think it was around three weeks before that. So early January to late January.

Jennifer Sprague (13:20):

Were you able to look at the health data on January 24th, 2023 that was in the defendant's phone extraction?

Ian Whiffin (13:27):

I was, yes.

Jennifer Sprague (13:29):

And what is health data and how does it show up on a phone?

Ian Whiffin (13:36):

The user of the phone would be able to access the health data via the health application where the information's broken down to explain how many steps have been taken over a particular period of time, the approximate distance that was traveled, the number of stair flights that were climbed. That data is stored on the device itself in a database. So as a forensic examiner, I can take a look at that database in its raw form, understand exactly where the information's coming from, and present it to the user of our forensic tools in a slightly more forensic-friendly method than the user of the application on the phone would see.

Jennifer Sprague (14:22):

Showing you on the screen here, page four of your report. Looking here, we have a section here, heart rate data. Is that correct?

Ian Whiffin (14:36):

Correct.

Jennifer Sprague (14:38):

And you're able to see here... What can you tell about the heart rate data from the extraction?

Ian Whiffin (14:48):

So heart rate data comes from wearing an Apple Watch or a similar device, not from the phone itself. In the case of this phone, there was an Apple Watch paired to the device and all of the heart rate data which is recorded periodically throughout the day is stored within the health database.

Jennifer Sprague (15:10):

And what was the name associated with the Apple Watch?

Ian Whiffin (15:16):

So as it says in the third paragraph down, the Apple Watch itself was called Lindsay's Apple Watch.

Jennifer Sprague (15:22):

And here in the report, you're able to show the recorded heart rates throughout the day. How is the heart rate recorded and sent to the phone?

Ian Whiffin (15:36):

There are sensors on the Apple Watch itself on the rear, which periodically check the heart rate at any given time. And that information is sent to the phone via Bluetooth.

Jennifer Sprague (15:52):

And are you aware of how often an iWatch will record the data and report it to an iPhone?

Ian Whiffin (16:01):

The actual cadence at which the watch is checking would depend on what the user's doing. So if you are in the middle of a workout, it would be a lot more consistent than just periodically throughout the day. And I actually don't know how often it is throughout the day if you're not doing any particular workout. There doesn't seem to be a set cadence. Every device I've looked at, it's slightly different.

Jennifer Sprague (16:26):

I'm showing you page five of your report, this database of the heart rates. For example, in several locations, there'll be a heart rate report, maybe a few seconds in between them. In others, there's seven or eight minutes in between the heart rate report. Is that where you're talking about how it varies depending on what you're doing at that point in time?

Ian Whiffin (16:52):

Yes, this is typical from what you see when you look at the database. The timestamps are never consistently a recognizable cadence.

Jennifer Sprague (17:02):

And the highlights in green, what do those represent?

Ian Whiffin (17:06):

So I actually tried to just highlight some of the high points for the day. I realized a few days ago while reviewing this, there was records there that show a high of 123 and 122, which I had not highlighted.

Jennifer Sprague (17:19):

And that's right there-

Ian Whiffin (17:20):

Correct.

Jennifer Sprague (17:21):

11:46?

Ian Whiffin (17:22):

Yes.

Jennifer Sprague (17:23):

And what was the last time a heart rate was reported from the watch to the defendant's phone?

Ian Whiffin (17:31):

So the last heart rate recorded was at 17:23:52. So 23 minutes past 5:00 in the afternoon with a heart rate of 57 beats per minute.

Jennifer Sprague (17:40):

What was the average heart rate for the day for the defendant's phone?

Ian Whiffin (17:45):

There was a range of heart rates going between as low as I believe around 50 and as high as around 122. On average, it was around high 80s, early 90s.

Jennifer Sprague (18:01):

And so at 5:23 PM, the last recording of her heart rate was 57?

Ian Whiffin (18:06):

Correct.

Jennifer Sprague (18:12):

And there aren't any further heart rates reported to the phone after that point, correct?

Ian Whiffin (18:17):

That's correct.

Jennifer Sprague (18:18):

And what are some of the reasons why a watch would no longer be reporting a heart rate to the phone?

Ian Whiffin (18:25):

If the watch was taken off, if the watch was turned off.

Jennifer Sprague (18:30):

If the battery died?

Ian Whiffin (18:31):

If the battery was dead, yes.

Jennifer Sprague (18:43):

Okay. You also mentioned flight climb data. What is that?

Ian Whiffin (18:47):

Flight climb is information which the Apple Health application stores every time it detects that you walk up a flight of stairs. So a flight of stairs will be considered either a three meter or 10 foot incline over 16 steps. So the device has detected that both the altitude has changed by 10 feet and there were steps being walked at the same time.

Jennifer Sprague (19:14):

So there's two factors being considered there. The steps that your watch monitors as you walk and then the altitude. Is that correct?

Ian Whiffin (19:21):

That's correct.

Jennifer Sprague (19:22):

And what is it? Is it GPS or something that's keeping track of your altitude?

Ian Whiffin (19:27):

The altitude is being monitored by a barometer or an altimeter, which is inside the device, just measuring for differences in air pressure.

Jennifer Sprague (19:35):

And this information, the flight climb data, can that be monitored by both a watch and your phone if you have it on you?

Ian Whiffin (19:43):

It is. Both devices have got the barometers built in. Both devices can monitor flight climb events.

Jennifer Sprague (19:51):

Can anything simulate or kind of fake out the watch or the phone into thinking that a flight of stairs is being climbed when it's not?

Ian Whiffin (20:04):

There are some circumstances where that can happen. They're typically quite rare, but it can happen.

Jennifer Sprague (20:13):

Is an example of that being in a car and going up a hill?

Ian Whiffin (20:16):

Correct. Yes. If there is movement which the device can mistake for steps at the same time as the incline is being driven, then that could accidentally record a flight climb.

Jennifer Sprague (20:29):

But if a person's not in a car and is in their home, then it would be flights climbed, not hills being driven, correct?

Ian Whiffin (20:39):

Correct. If the person is in a house and there are flight climbs being recorded, then the only rational explanation is that the person was climbing stairs.

Jennifer Sprague (20:55):

In terms of flight climb data, how is that data displayed in the health data itself?

Ian Whiffin (21:04):

Within the application or within the forensic tool?

Jennifer Sprague (21:08):

Within the forensic tool.

Ian Whiffin (21:09):

Okay. So within the forensic tool or within physical analyzer, we break down the health data into our segments. So for an hour we may say that there are three flight climbs and then it's up to the user to dig in a little further. They can select that one hour and then see how that activity breaks down over the hour. So you would see that there were two flight climbs that occurred 10 minutes after the hour and then another flight climb occurred later on.

Jennifer Sprague (21:40):

So showing you page six of your report here, the top box here, is that showing the general hour data where three flights have been climbed?

Ian Whiffin (21:58):

Correct. So in this case, the user's looking at a time period between 10:00 AM and 11:00 AM and the health data that's been pulled from the database has been aggregated. And it tells you that there's 98 samples being considered. The maximum heart rate during that hour-long period was 108. The distance traveled was approximately 759 meters, and there were five flights climbed within that hour.

Jennifer Sprague (22:25):

And then below that, you break that down a little further, correct?

Ian Whiffin (22:30):

Correct. So this is further down the screen in the interface where we can see actual time of 10:17:27 where there's two flights climbed. And again, another record at 10:17:28 where there were two flights climbed and then a further flight climb at 10:49.

Jennifer Sprague (22:50):

And then going down to the bottom here, this table, what are we seeing here in this table?

Ian Whiffin (22:57):

So you may have realized in the slide above where there was two flight climbs at 17 seconds past and two flight climbs at 18 seconds past. That's an unrealistic measurement. It's because one of those measurements comes from the phone and one comes from the watch. This table breaks it down to say which of these records came from the watch and which came from the phone because there are some which overlap.

Jennifer Sprague (23:24):

So what you're saying is the prior table, it showed the four flights of stairs being climbed at the same time within seconds, which isn't rational. But this breaks it down to show some of that data is coming from the watch and some of it's coming from the phone, correct?

Ian Whiffin (23:39):

Correct. So if we look at records at four and five here, for example, we can see a start time of 10:17:27 and an end time of 10.27:06 where the watch recorded two flight climbs. And then one second later, a start time and two seconds later for the end time, we see the watch also detected two flight climbs. This is just the same two flight climb events that happened, but both devices recorded those flight climbs with slightly different timestamps.

Jennifer Sprague (24:09):

And that will happen if I'm wearing my watch and I have my phone in my pocket and I go up the stairs?

Ian Whiffin (24:13):

That's correct.

Jennifer Sprague (24:14):

Did you do something to compare these times and make a table where you ignored or disregarded the double entries?

Ian Whiffin (24:36):

I did. I tried to correlate and discard all of the duplicate information. So where there was an event of a flight climb that was recorded on the watch on the phone, rather than provide information that said there was two flight climbs, I would ignore one of them and limit it to just the ones which we could prove happened.

Jennifer Sprague (24:56):

And that's displayed here in this chart at the bottom of page seven of your report?

Ian Whiffin (25:00):

Correct.

Jennifer Sprague (25:07):

Going to page eight of your report, we have here at the top of page eight, does that show the last flight climbs recorded on either the defendant's phone or watch?

Ian Whiffin (25:27):

It does. It shows that there was additional flight climb events logged by the phone, which were not logged by the watch at 17:03 and 17:33.

Jennifer Sprague (25:38):

So these records indicate that at 5:03 PM, the defendant's iPhone was with the person as it went up the stairs. And then at 5:33 PM, the iPhone was with the person as it went up the two flights of stairs?

Ian Whiffin (25:53):

Correct.

Jennifer Sprague (25:54):

And there's a time difference there. The start time is 5:33 PM and the end time is 5:38 PM for two flights of stairs. So that's roughly five minutes in between the two flights. Is there a way to explain that length of time?

Ian Whiffin (26:12):

The way the Apple Health data records this information aggregates it. It tries to group events together. So in this case, it would've recognized that there was a flight climb on the phone at around 17:33:34 and a second one at around 17:38: 33. And it just grouped them both into one event. It doesn't mean that it took five minutes to walk up two flights of stairs. It's just within that five minute period there were two flight climbs.

Jennifer Sprague (26:42):

So if I have my phone in my pocket and I climb up a flight of stairs and then I spend a few minutes on that floor and then still with my phone in my pocket, go up another flight of stairs, that's representative of what we're seeing here at 5:33?

Ian Whiffin (26:57):

Correct. There tends to be around a 10-minute window where it tries to check every 10 minutes, but it can reduce that window in a case like this where it sees that there's group data within a smaller time period.

Jennifer Sprague (27:11):

And then further down on page eight, we have another table here, which seems to have combined data of heart rate and flight climb data. Is that correct?

Ian Whiffin (27:21):

Correct.

Jennifer Sprague (27:30):

Did you also look at web usage on the extraction of the defendant's phone?

Ian Whiffin (27:56):

I did, yes.

Jennifer Sprague (27:56):

And what did you do to look at the web usage on the phone and what timeframe did you look at?

Ian Whiffin (28:01):

For web usage, I expanded the time of interest to early January to the 24th of January. I just took a look at any web history over that time. There was over 1,300 records recovered. I took a cursory look down that list and highlighted some which potentially were relevant to the case, and then provided the 1,300 actual records as a appendix report.

Jennifer Sprague (28:30):

And going to page 12 of your report, looks like you started here on January 10th, 2023. Is that correct?

Ian Whiffin (28:48):

That's correct.

Jennifer Sprague (28:53):

And basically here you list various searches that occurred on each day between January 10th and January 24th from the extraction. Is that correct?

Ian Whiffin (29:04):

That's correct. Broken down by day with the time of the search, the website that was visited, the title of the webpage, and then the identifier in the database.

Jennifer Sprague (29:22):

And looking at these searches, on January 12th, 2023 at 19:48, so that would be 7:48 PM, is that correct?

Ian Whiffin (29:40):

Correct.

Jennifer Sprague (29:41):

There was a search. In the title it says, "How Quickly Does Wellbutrin Work for Depression?" The title, is that what the user is putting into the search?

Ian Whiffin (29:51):

If I could see the search, please.

Jennifer Sprague (29:51):

I'll zoom in on that.

Ian Whiffin (30:13):

The top entry here we can see starts with httpswwwgoogle.com/search?q. The text after the Q, "How quickly does Wellbutrin work?" is what the user searched. Typically, that is exactly as the user typed it, assuming that there are no autocompletions in place. In this particular case, it appears it was searched using Safari. So there's no autocompletion that is essentially what the user typed in. And then the title, "How quickly does..." I can't say that word, I'm afraid.

Jennifer Sprague (30:56):

Wellbutrin?

Ian Whiffin (30:56):

"Wellbutrin," thank you, "Work for Depression Google Search" is the title of the page which Google assigns.

Ian Whiffin (31:00):

Which is the title of the page which Google assigns.

Jennifer Sprague (31:04):

So where it says after the queue, how plus quickly plus does plus, the user's not putting in those pluses, correct? What were you calling those?

Ian Whiffin (31:13):

So that's part of the attribute. It's how the data's encoded in a URL or in a web search. You can't have spaces within this address string. So they replace the spaces with the plus symbol.

Jennifer Sprague (31:33):

So I type in how quickly does... And the computer adds the pluses in the space box?

Ian Whiffin (31:33):

Yes. It's URL encoding to make it safe for the browser.

Jennifer Sprague (31:40):

And then at 7:49, there's a search for Lamictal for depression?

Ian Whiffin (31:46):

Yes. And depression spelled with a B at the end instead of an N, which demonstrates that this is what the user typed in rather than a page that was being visited.

Jennifer Sprague (31:58):

And then a few minutes later at 7:55 PM, the user typed in Elavil for depression, correct?

Ian Whiffin (32:03):

Correct.

Jennifer Sprague (32:22):

And then on page 16, on January 18th, 2023 at 10:25, we had a search there, ketamine for suicidal ideation. Is that correct?

Ian Whiffin (32:47):

Correct.

Jennifer Sprague (32:48):

And again, that's the user typing that in?

Ian Whiffin (32:50):

Yeah. Again, those words were typed in by the user.

Jennifer Sprague (33:02):

And then on January 19th, 2023, on page 17 of your report, we have symptoms of postpartum psychosis searched on January 19th?

Ian Whiffin (33:18):

Correct.

Jennifer Sprague (33:22):

And again, so we're looking at... This is AM, correct? 9:24 AM that was searched?

Ian Whiffin (33:28):

Yes, the morning.

Jennifer Sprague (33:29):

And then 9:30 AM, there's another search for psychosis symptoms?

Ian Whiffin (33:32):

Yes.

Jennifer Sprague (34:04):

Going back to that same page, page 17, at the bottom for January 24th, we have here searches for kids MiraLAX at 02:02 PM and takeout 3v at 4:13 PM. Is that correct?

Ian Whiffin (34:23):

That's correct.

Jennifer Sprague (34:24):

And then CVS Pharmacy at 4:47 PM, correct?

Ian Whiffin (34:28):

Correct.

Jennifer Sprague (34:37):

There was also an Apple note that you found in the records, correct?

Ian Whiffin (34:41):

There was.

Jennifer Sprague (34:43):

The Apple note, in your report, it says it was created on December 22nd, 2022 at 10:23 AM. Strike that. And then modified at 10:23 AM on January 23rd, 2023, correct?

Ian Whiffin (34:57):

Correct.

Jennifer Sprague (34:58):

And are you able to tell what in the note was modified?

Ian Whiffin (35:03):

No, there's no real auditable log to look back and see how many times it's been modified over the course of its life. I was able to do some amount of recovery to see that on the day it was created, it started in a very similar way to as it's written on the 24th or 23rd of January. But the exact changes between when it first was created and the last time it was modified, we don't know.

Jennifer Sprague (35:32):

And then you also looked at messages, correct?

Ian Whiffin (35:34):

Correct.

Jennifer Sprague (35:36):

And were you able to compile the messages that were sent and received between the defendant and her mother and the defendant and her husband on January 24th, 2023?

Ian Whiffin (35:47):

I did, yes.

Jennifer Sprague (35:48):

And were you able to arrange it using the tools that you use in a way that looks like you might see it on your phone?

Ian Whiffin (35:57):

Yeah, I tried to prepare it in a report, which would be easy for any viewer to understand based on their own usage of text messaging.

Jennifer Sprague (36:07):

So showing you page 19 of your report, what we have here is an enlarged version of what you might see on your phone, correct?

Ian Whiffin (36:18):

Correct.

Jennifer Sprague (36:20):

And so someone's... In blue, is this Lindsay's phone?

Ian Whiffin (36:23):

It is. The messages in blue on the right would be outgoing. The messages in gray on the left would be incoming.

Jennifer Sprague (36:30):

And so you have a photo being sent out from Lindsay's phone to her mother and then a reply coming back and that pattern goes on and on, correct?

Ian Whiffin (36:40):

Correct.

Jennifer Sprague (36:49):

And then looking at page 22, you were able to do the same in terms of her contact with Patrick Clancy that day, correct?

Ian Whiffin (36:57):

I did, yes.

Jennifer Sprague (36:58):

And so in gray, we have Patrick Clancy sending a message to Lindsay Clancy and in blue is the response, correct?

Ian Whiffin (37:05):

Correct.

Jennifer Sprague (37:42):

Excuse me. Were you also able to look at the phone calls that occurred either incoming or outgoing to the defendant's phone on January 24th, 2023?

Ian Whiffin (37:52):

I did, yes.

Jennifer Sprague (38:01):

And looking at page 27 and 28 of your report, first on page 27, just looking closely at the phone, here in the report it says 2024. Is that a typo? Is that supposed to be 2023?

Ian Whiffin (38:15):

That's meant to be 2023, yes. I apologize.

Jennifer Sprague (38:18):

Okay. And so what we see here, can you just tell us what these columns are?

Ian Whiffin (38:22):

Yeah. The start time of the call, typically when it is answered by the recipient, the end time when the calls ended. The metadata is information including who the call was to or from, how long the call lasted, and then the reason that the call disconnected. And then a record ID. So if you had the database, you could go in and find this record based on the ID number.

Jennifer Sprague (38:51):

And looking at page 28, this is the continuation of that table regarding the phone calls. Is that correct?

Ian Whiffin (39:00):

Correct.

Jennifer Sprague (39:00):

And so what we're seeing here is at 17:33, which would be 5:33 PM, there's an incoming call from Patrick to Lindsay's phone. Is that correct?

Ian Whiffin (39:11):

Correct.

Jennifer Sprague (39:11):

And it says duration, eight seconds. Sorry, zero seconds. Does that mean it was not answered?

Ian Whiffin (39:18):

In this case, it was an answered call.

Jennifer Sprague (39:19):

And then at 5:34 PM, roughly a minute later, there's an outgoing call from Lindsay's phone to Patrick's, correct?

Ian Whiffin (39:26):

Correct.

Jennifer Sprague (39:27):

And that call was approximately 14 seconds?

Ian Whiffin (39:30):

Correct.

Jennifer Sprague (39:31):

And then at 6:09 PM, another incoming call from Patrick to Lindsay that went unanswered?

Ian Whiffin (39:37):

That's correct.

Jennifer Sprague (39:52):

Now you also, in a section you called media, you have some photographs that were taken from the phone with some metadata included, correct?

Ian Whiffin (40:02):

Correct.

Jennifer Sprague (40:03):

What is metadata?

Ian Whiffin (40:05):

Metadata is information about that photograph. It could be the device that captured it, the time that it was captured, the location, information about the lens, the lighting, et cetera.

Jennifer Sprague (40:17):

And so looking at page 29 of your report, just for an example, what we have here are three photographs, correct?

Ian Whiffin (40:26):

Correct.

Jennifer Sprague (40:27):

And the metadata for the first one shows captured at South Shore Medical Center. Is that correct?

Ian Whiffin (40:33):

Correct.

Jennifer Sprague (40:34):

How were you able to determine that's where that photograph was taken?

Ian Whiffin (40:37):

The metadata of the photo included the latitude and longitude where the image was captured. I took that latitude and longitude and looked on Google Maps to see a physical address. In this case, it came down to the South Shore Medical Center.

Jennifer Sprague (40:56):

And then the third photo here, that shows captured at the home address on Summer Street. Is that correct?

Ian Whiffin (41:04):

Correct.

Jennifer Sprague (41:10):

And then you looked at device usage. What is device usage?

Ian Whiffin (41:21):

Device usage would relate to how the user is operating the device. So when they have it unlocked, locked, what applications being used any particular time. Essentially, anything which is not a message or a phone call or results in additional data like that.

Jennifer Sprague (41:39):

And looking at page 32 of your report, in that device usage log, it shows that the last time the device usage was logged was at 5:13 PM, correct?

Ian Whiffin (41:52):

So this table relates just to the locking and the unlocking of the device. So the last time the device was unlocked was at 17:13: 16. The device was locked again around two minutes later at 17:15:12, and the device was not unlocked again.

Jennifer Sprague (42:10):

And so where the device was not unlocked again after 5:16 PM, but we have a phone call being made at 5:34 PM. How does that happen?

Ian Whiffin (42:22):

There is a setting within iPhones that allow you to use a locked device to call back numbers for missed calls. So in this case, Lindsay had the missed phone call that would've shown on screen as a notification as a missed call. And without unlocking the device, you're able to call that person back.

Jennifer Sprague (42:42):

So you just press on the icon that shows up, you have a missed call, you press on that, and you can call the person back without unlocking the phone?

Ian Whiffin (42:49):

Correct.

Jennifer Sprague (42:53):

And then what is application focus?

Ian Whiffin (42:56):

Application focus is literally the application which is visible on screen at any given time.

Jennifer Sprague (43:03):

And at 4:13 PM, 16:13 on January 24th, you've highlighted it in green here. What are we seeing there?

Ian Whiffin (43:17):

At 16:13:23 until 16:14:50, the Apple Maps application was being used, visible on screen.

Jennifer Sprague (43:35):

Is it then used again at 5:13 and 5:14 PM? Or is that a different application?

Ian Whiffin (43:44):

So at 5:13 until 5:14, it was mobile Safari. So the mobile version of Safari, the internet browser was on-screen. And at 17:14:47 until 17:15:08, it was the mobile SMS or messaging application, which was on-screen.

Jennifer Sprague (44:03):

So do you just look at the part that's in parentheses to see what application was open or being used at the time?

Ian Whiffin (44:12):

Correct. What application was on-screen at the time.

Jennifer Sprague (44:14):

So for example, where it says 17:34, which would be 5:34 PM and in parentheses is in-call service. Does that represent a phone call?

Ian Whiffin (44:22):

It does. That's the screen that indicates you are in a phone call.

Jennifer Sprague (44:28):

And staying with the same page, page 34, you've made some notes here. Let's go out a little bit, regarding Apple Maps, Safari, and messaging. So can you just explain what you pulled from the data for Apple Maps?

Ian Whiffin (44:46):

Yeah. Apple Maps was used to plan a route from the user's current location, the home address, to a restaurant called 3V.

Jennifer Sprague (44:57):

And that was at 4:13 PM?

Ian Whiffin (44:57):

It was.

Jennifer Sprague (44:59):

And then in terms of Safari, you have the last unlock at 5:13 PM?

Ian Whiffin (45:05):

Yes. So the last unlock of the device was used for the purposes of viewing Safari where PDLX was searched using Google.

Jennifer Sprague (45:16):

And then in terms of messaging, what did you pull from the data there?

Ian Whiffin (45:19):

At the same time or in that same device usage. So the device was unlocked, Safari was used to search PDLX, and then the messaging application was opened to send a message to Patrick saying PDLX liquid stool softener.

Jennifer Sprague (45:34):

And that was at 5:15 PM?

Ian Whiffin (45:37):

It was.

Jennifer Sprague (45:44):

And then did you create a timeline combining all the data that we've talked about into one timeline?

Ian Whiffin (45:50):

I did, yes.

Jennifer Sprague (46:07):

And going to the last page of your report, page 43, is this the last page of the timeline?

Ian Whiffin (46:13):

It is, yes.

Jennifer Sprague (46:23):

And in that page, can you explain what we're seeing here?

Ian Whiffin (46:29):

Yes. So the very first column is the timestamp. The next few columns which show typically colored is related to the activity, which will become a little bit clearer in a moment. The column in the center explains what the record is. So if, for example, we look at the 17:13:16 record, we can see a U, which means the device was unlocked in pink. That unlock event lasted until 17:15:12. So hence that entire column is in pink and shows the relevant lock event.

Jennifer Sprague (47:14):

So here we have 5:13 device unlock.

Ian Whiffin (47:18):

Yes.

Jennifer Sprague (47:19):

5:15 device lock, and there's this column connecting them, correct?

Ian Whiffin (47:22):

Correct. And then any activity that happened during that unlock time is then shown within the rows between. So again, we see Safari open at 17:13:16. Safari was closed at 17:14:47. Messaging was opened at 17:14:47. While messages were opened, there was an outgoing message sent for PDLX. Then messaging was closed. Messaging was opened again and messaging was closed prior to the device locking. So everything in the colored columns tries to show all of the events that happened at the same time or during that parent event.

Jennifer Sprague (48:08):

And what we have here at 5:33 PM, we have the flight climb started. Is that correct?

Ian Whiffin (48:13):

Correct.

Jennifer Sprague (48:15):

And flight climb ended at 5:38. So that line again connecting them?

Ian Whiffin (48:19):

Correct. So two flight climbs occurred during that time period.

Jennifer Sprague (48:23):

And in between when the flight climb started and the flight climb ended, you had the two calls, the incoming call that was missed from Patrick and then the outgoing call to Patrick, correct?

Ian Whiffin (48:33):

Correct.

Jennifer Sprague (48:35):

So the first flight climbed had already been started. Someone had already started climbing up a flight of stairs when that first unanswered call happened, correct?

Ian Whiffin (48:46):

So flight climb started is how it's listed within the database and within the software. But it actually... The flight climb time is when the flight climb has been recognized by the device as the device has already climbed up those stairs. So even though it says flight climb started, that's technically the time that the flight climb or the first flight climb had ended.

Jennifer Sprague (49:12):

So where it says 5:33:34 flight climb started, that actually indicates the person has gone up that first flight of stairs already?

Ian Whiffin (49:23):

Yes. That indicates the phone has now realized I'm three meters higher than I was the last time I checked. Therefore, a flight climb has already been completed at that point.

Jennifer Sprague (49:35):

And then the calls happen, and then the phone realizes at 5:38 that another flight has been climbed?

Ian Whiffin (49:39):

Correct.

Jennifer Sprague (49:51):

I would move to submit the report as the next exhibit.

Mr. Reddington (49:53):

No objection.

Judge William Sullivan (49:53):

All right. The report may be admitted.

Speaker 3 (49:53):

1566.

Jennifer Sprague (49:53):

I have nothing further.

Judge William Sullivan (50:05):

All right. All right. So members of the jury, remember I said it might be a little stop and start here today. This is one of those stops. All right. So we're going to take a short break and then we'll come right back and return for the cross-examination of this witness. Okay?

Madam Clerk (50:21):

All rise please, Jurors. Thank you.

Speaker 1 (50:57):

Kendra might be coming here on Thursday.

Speaker 2 (50:59):

Why?

Speaker 1 (50:59):

She's doing that.

Speaker 2 (50:59):

Oh, staying after.

Madam Clerk (50:59):

Jurors have exited the courtroom. The court's in session.

Judge William Sullivan (51:08):

All right. So the court will be in a short recess at this time. Thanks.

Madam Clerk (51:30):

Court, all rise. This court is back in session. You may be seated.

Judge William Sullivan (51:34):

Yeah. Counsel, we ready for the jury?

Jennifer Sprague (51:35):

Yes.

Mr. Reddington (51:35):

Yes.

Judge William Sullivan (51:35):

All right. Yeah.

Mr. Reddington (51:35):

All right.

Madam Clerk (52:39):

All rise please. Jurors entering. Court is back in session. You may be seated.

Judge William Sullivan (53:19):

All right. Thank you, Madam Clerk. Mr. Reddington.

Mr. Reddington (53:22):

Thank you, Your Honor. Morning.

Ian Whiffin (53:23):

Good morning.

Mr. Reddington (53:25):

Mr. Whippen, just a couple of things. One of the takeaways or question that I had is that you were talking about in reference to the Apple Health data. Fair to say that there's an issue as to the accuracy or reliability of the Apple Health data that you've actually done research on, right?

Ian Whiffin (53:46):

I've done research on it, yes.

Mr. Reddington (53:48):

Okay. And one of the things that you did is back about a year ago, June 28th of 2025, you did a blog article on Apple Health accuracy and reliability. And it talked about using a pitch, which I think you guys referred like a football field or something?

Ian Whiffin (54:06):

It was a Brooklyn field, yes.

Mr. Reddington (54:07):

And then you had somebody put the watch in their right pocket, somebody with the left pocket, and then someone else held it in your hand, you measured it and things of that nature, right?

Ian Whiffin (54:15):

Correct. It was three phones.

Mr. Reddington (54:17):

Some of the things were off a little bit, but basically you put that in your report and you were able to draw your conclusion as to the accuracy and reliability, as you say, of the Apple Health data, right?

Ian Whiffin (54:28):

Correct.

Mr. Reddington (54:29):

Now, if someone is wearing an Apple Watch, is that what records heart rate?

Ian Whiffin (54:38):

The heart rate is on the watch, yes.

Mr. Reddington (54:39):

It is on the watch?

Ian Whiffin (54:40):

Yes.

Mr. Reddington (54:40):

Okay. And the steps that the person takes, things of that nature, the movement, is that on the phone or would that be on the watch?

Ian Whiffin (54:48):

That's on both the watch and the phone.

Mr. Reddington (54:50):

Okay. Now, if you have an Apple Watch and you test it or you examine it, would you be able to determine what information was actually recorded by the watch while the person was wearing it?

Ian Whiffin (55:05):

Yes. The information that's recorded within the Apple Health database does specify whether the information comes from the watch, the phone, or from a different device.

Mr. Reddington (55:15):

Okay. And in this case, if I understand correctly, the Apple Watch stopped recording data at, is it 5:23?

Ian Whiffin (55:27):

It was around that time.

Mr. Reddington (55:29):

Okay. You know what? I'm going to give you your report. Feel free to just refresh your memory or look at it or whatever helps you out.

Ian Whiffin (55:37):

Thank you.

Mr. Reddington (55:38):

Yep. No problem. I just want to get the times down. I think you indicated that the watch stopped recording information at 5:23 PM.

Ian Whiffin (55:52):

Yes. The last heart rate was 5:23:52.

Mr. Reddington (55:58):

52. Okay. 5:23 and 52 seconds. And then I believe the phone and watch stopped recording at 5:38, was it?

Ian Whiffin (56:09):

The last usage of the... Let me double-check this. I believe the last usage of the phone to record flight climb data was at 5:38. Yes.

Mr. Reddington (56:24):

All right. And after 5:38, it's pretty much blackout. There's no further information or recording, right?

Ian Whiffin (56:32):

Yes. Not until the phone was seized by police, I believe.

Mr. Reddington (56:36):

By the police.

Ian Whiffin (56:38):

There's other activity, but appeared to be after the incident.

Mr. Reddington (56:42):

So the further activity would have been the following morning on the 25th of January, say around 5:30, 6:00 in the morning?

Ian Whiffin (56:54):

I ended my analysis on the 24th.

Mr. Reddington (56:57):

Okay. Well, so 5:23 PM, the watch stops recording information. 5:38 PM, both the watch and the phone stopped recording any information until the police picked up the phone apparently the following day, right?

Ian Whiffin (57:15):

Again, there would've been activity later on, but it wasn't usage. It wasn't health data. It would've been things like incoming calls, if there were any.

Mr. Reddington (57:25):

Okay. So when you went through the stair climbing and talked about the steps that were taken, the distance that was taken, that stopped at 5:38 PM, right?

Ian Whiffin (57:39):

Correct.

Mr. Reddington (57:40):

Now you don't know, when I say you, I mean as a witness, but also the police. Whoever was wearing the watch, for example, if Lindsay's wearing the watch or carrying the phone after 5:38, you don't know what was happening at 5:39?

Ian Whiffin (57:57):

Correct.

Mr. Reddington (57:57):

You don't know what was happening at 5:40, 5:45, right?

Ian Whiffin (58:00):

Correct.

Mr. Reddington (58:01):

Right up till 5:58, 6:00 PM, right?

Ian Whiffin (58:04):

Purely the data on the device.

Mr. Reddington (58:06):

So it could have been, the phone could have been put down, the watch could have been put down, battery died, whatever those issues could be. And the person would still be going down the stairs, going up the stairs, going in the backyard, doing pushups, whatever.

Ian Whiffin (58:23):

Correct.

Mr. Reddington (58:23):

You just don't know, right?

Ian Whiffin (58:24):

Yes.

Mr. Reddington (58:24):

Okay. One of the things... You're familiar with the concept of location data, right?

Ian Whiffin (58:33):

Correct.

Mr. Reddington (58:34):

And location data, one of the things you looked at or you're aware of would be from Lindsay's phone on August 23rd of 2022. Is that correct?

Ian Whiffin (58:45):

Apologies. August 23rd, 2022?

Mr. Reddington (58:47):

Yeah.

Ian Whiffin (58:47):

I didn't go back anywhere near that date.

Mr. Reddington (58:51):

You have tested and written blogs though on location information, right?

Ian Whiffin (58:55):

Correct.

Mr. Reddington (58:55):

You actually testified in the case of Commonwealth versus Victor Arrington in Suffolk Superior Court in Boston in support of the accuracy of this particular artifact or information, right?

Ian Whiffin (59:07):

Correct.

Mr. Reddington (59:08):

So you're a true believer that the phone does in fact record accurately significant locations on the iPhone, right?

Ian Whiffin (59:17):

It certainly can, yes.

Mr. Reddington (59:18):

All right. And are you aware, or if I was to approach you in your expertise... It's just the doctor. That's all. You were talking earlier about latitude, longitude, things of that nature, right?

Ian Whiffin (59:49):

Yes.

Mr. Reddington (59:50):

Okay. So just to get familiar with, for example, significant location visits on Lindsay's phone, August 23rd, 2022 at 9:34. Do you know what that says or what that means?

Ian Whiffin (01:00:07):

The created time?

Mr. Reddington (01:00:09):

Yeah.

Ian Whiffin (01:00:09):

Of 9:34? When the device decided that the device had visited this location enough to consider a visit.

Mr. Reddington (01:00:20):

Okay. Do you know what that location is? If I suggest to you it's a doctor's office, would you be aware of that?

Ian Whiffin (01:00:26):

I don't recognize it from the coordinates.

Mr. Reddington (01:00:28):

Okay. Thank you. This here, you're familiar with too, as well, right? The geo data with the latitude and the longitude?

Ian Whiffin (01:00:48):

Yes.

Mr. Reddington (01:00:49):

And you're familiar with the fact that you can take the metadata off of the information on the cell phone, one of which would be latitude and longitude. You'd be able to determine, for example, that this would be the Lindsay Clancy home, correct?

Ian Whiffin (01:01:02):

Yes, correct.

Mr. Reddington (01:01:02):

You've seen this before, right?

Ian Whiffin (01:01:04):

It rings a bell, yes.

‍