2.Timothy Chiappini — Direct (Part 1)
409 linesMS. SPRAGUE: Commonwealth calls Timothy Chiappini.
COURT CLERK: Good morning. Do you solemnly swear that the testimony and the evidence you shall give to the court and the jury in the matter now pending between the Commonwealth and the defendant at the bar shall be the truth, the whole truth, and nothing but the truth, so help you God?
TIMOTHY CHIAPPINI: I do.
COURT CLERK: Thank you, sir. You may have a seat.
BAILIFF: Watch your step, please.
THE COURT: All right. Good morning, sir.
TIMOTHY CHIAPPINI: Good morning.
THE COURT: Attorney Sprague, please.
MS. SPRAGUE: Thank you. Good morning. Can you please state and spell your name for the record?
TIMOTHY CHIAPPINI: My name is Timothy Chiappini. Last name is spelled C-H-I-A-P as in Peter, P as in Peter, I-N-I.
MS. SPRAGUE: Where do you work?
TIMOTHY CHIAPPINI: I work for the Commonwealth of Massachusetts for the Department of State Police.
MS. SPRAGUE: How long have you worked for the State Police?
TIMOTHY CHIAPPINI: I graduated the academy in March of 2012.
MS. SPRAGUE: What is your current assignment?
TIMOTHY CHIAPPINI: I am currently the unit commander for the Critical Incident Technical Investigations Team.
MS. SPRAGUE: How long have you been doing that?
TIMOTHY CHIAPPINI: Since approximately April of this year.
MS. SPRAGUE: What was your assignment in January of 2023?
TIMOTHY CHIAPPINI: I was assigned to the State Police detective unit for the Plymouth County District Attorney's office.
MS. SPRAGUE: Do you have specialized training in cellphone forensics?
TIMOTHY CHIAPPINI: I do.
MS. SPRAGUE: And could you describe that, please?
TIMOTHY CHIAPPINI: I was initially certified as a Cellebrite physical operator and a Cellebrite phy—excuse me, Cellebrite certified operator, Cellebrite certified physical analyst in March of 2017.
MS. SPRAGUE: And are you also trained in GrayKey and Magnet?
TIMOTHY CHIAPPINI: I have been trained in GrayKey examination since August of 2021, and I've been familiar with the forensic program known as Axiom in that course, but I am not certified in Axiom.
MS. SPRAGUE: And regarding Cellebrite, can you describe that software for us?
TIMOTHY CHIAPPINI: Cellebrite is a forensic access and acquisition tool for cellphone or mobile device forensic extractions. It also has an analysis component as well.
MS. SPRAGUE: And were you asked to do a forensic analysis on a cellphone belonging to Lindsay Clancy in 2023? Oh, I'm sorry.
TIMOTHY CHIAPPINI: Yes, ma'am. Cellebrite is an access and acquisition tool for mobile device forensics and cellphone extractions. It also has an analysis component for extractions.
MS. SPRAGUE: And were you asked to do a forensic analysis on a cellphone belonging to Lindsay Clancy in 2023?
TIMOTHY CHIAPPINI: I was.
MS. SPRAGUE: Did you do that?
TIMOTHY CHIAPPINI: I did.
MS. SPRAGUE: And how did you do that?
TIMOTHY CHIAPPINI: I performed an advanced logical extraction on the iPhone device belonging to Lindsay Clancy.
MS. SPRAGUE: Can you tell us what that means in just lay terms that we could all understand?
TIMOTHY CHIAPPINI: An advanced logical extraction of an iPhone is essentially an iTunes backup. It is the information or data from the phone that you as a user can see, including images, calls, text messages, browser artifacts, basically everything that the person would see that uses an iPhone.
MS. SPRAGUE: And is it just making a copy of everything that you can see on that phone?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: And what is the analysis portion of... You mentioned you do Cellebrite extraction and Cellebrite analysis. What's the analysis portion?
TIMOTHY CHIAPPINI: In January of 2023, the analysis software would be Cellebrite Physical Analyzer, and with that you can also export a report to be utilized in Cellebrite Reader.
MS. SPRAGUE: So basically, are you just taking someone's phone, making a copy of the data that's on it, and then looking through the data?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: Is it an exact copy?
TIMOTHY CHIAPPINI: Yes. When the phone is forensically extracted by the Cellebrite software, a hash value is created. A hash value is a unique digital fingerprint of the extraction. It's a alphanumeric string of characters, and every time the extraction is opened in the Cellebrite software, that hash value is verified. If the data in the extraction is changed by just one bit, the hash value would be changed, and the extraction would no longer be valid.
MS. SPRAGUE: So basically you look at those numbers, the number chain, to make sure they're the same, and then you know it's an exact copy?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: And did you do that in this case?
TIMOTHY CHIAPPINI: I did.
MS. SPRAGUE: And was it an exact copy?
TIMOTHY CHIAPPINI: It was.
MS. SPRAGUE: And are you able on the extraction to change any of the data while you're analyzing it?
TIMOTHY CHIAPPINI: No. That would invalidate the hash. I can use filters in the analysis to screen, to look at particular data that I want, but I can never change the contents of the extraction.
MS. SPRAGUE: And so when you say use different filters, can you, you know, put things in categories to organize it so that, for example, can you put all the photos together and all the text messages together?
TIMOTHY CHIAPPINI: The Cellebrite Physical Analyzer tool automatically parses the data into various categories. And it processes media, various forms of media, images, videos. It processes different direct communication, whether it be through a web application such as Instagram or the native messaging application on the device, known as iMessage. So it parses the information in automatically, and you're allowed to look at different categories.
MS. SPRAGUE: So does it create a report in, with all the data?
TIMOTHY CHIAPPINI: I can create a report from the extraction, and it has all the data contained in the report, and I can filter it based on the parameters that I'm required to... allowed to look at legally.
MS. SPRAGUE: And when you do that extraction of a phone, do you get everything that's on the phone?
TIMOTHY CHIAPPINI: Depending on the type of extraction, I get all the data that's available to me by the forensic tool that I'm using at the time.
MS. SPRAGUE: So do forensic tools improve over time to allow examiners to get more and more data from phones?
TIMOTHY CHIAPPINI: Yes.
MS. SPRAGUE: So basically, what you were able to get from Ms. Clancy's phone was what the tool you were using at the time was capable of getting at that time.
TIMOTHY CHIAPPINI: I performed the most comprehensive extraction type that I was able to do at the time of the examination.
MS. SPRAGUE: And then there were improvements to that system following what you did that may allow, may have allowed other examiners to get more information.
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: Were you asked to generate some reports about certain sections of the defendant's phone?
TIMOTHY CHIAPPINI: I was.
MS. SPRAGUE: We could pull up the...
MS. SPRAGUE: Could look at the screen, please. Were you able to create a report regarding data on Ms. Clancy's phone from November of 2022 to December of 2022?
TIMOTHY CHIAPPINI: Yes.
MS. SPRAGUE: Can you zoom in on that, please?
MS. SPRAGUE: And could you just explain for us the different columns we're seeing here?
TIMOTHY CHIAPPINI: The columns are automatically generated by the software when you create a supplemental report. This is a supplemental report created through the Cellebrite Physical Analyzer software analysis tool. When you create the supplemental report, you can stipulate to certain parameters, certain content, certain timeframes, based on your investigation. In this case, there are multiple columns at the top reflecting the different types of data, the timestamp for that data, a description in the source file for the data. This is a timeline report, and therefore it reflects those exact columns, and that is predetermined by the software.
MS. SPRAGUE: So for example, where it says type, what is that telling us?
TIMOTHY CHIAPPINI: That's where Cellebrite has parsed the data and categorized it based on the forensic extraction.
MS. SPRAGUE: So there at number one where it says activity sensor data, what is that?
TIMOTHY CHIAPPINI: That would be the data from the health database within the phone.
MS. SPRAGUE: If there was something in the direction box, what is direction?
TIMOTHY CHIAPPINI: Direction could be related to a call incoming to the device or outgoing from the device.
MS. SPRAGUE: So if one was a phone call, it would say to or from?
TIMOTHY CHIAPPINI: I believe the exact categorization would be incoming or outgoing.
MS. SPRAGUE: Incoming or outgoing. Okay. And then the attachment box?
TIMOTHY CHIAPPINI: Attachment box would be associated with a message, typically a MMS message or multimedia message. A text message that contains a photo would be listed as an attachment. It could also be associated with an email that has an attachment or some type of transaction on the phone that resulted in something being attributed as an intra attachment.
MS. SPRAGUE: And then what about the location box?
TIMOTHY CHIAPPINI: If the data source has location information associated with it, then that box would have data filled out. This report is seven hundred and sixty-eight pages, so there's a variety of sources of data within this report.
MS. SPRAGUE: And what about timestamp? Where it says timestamp, the date and time, is that Eastern Standard Time?
TIMOTHY CHIAPPINI: It is. It's UTC minus five, as the time of the search warrant... Excuse me. The timeframe of this incident occurred in January of 2023, therefore the extraction reflects the exact timeframe of time zone of the device at the time of the extraction.
MS. SPRAGUE: And where it says party, what would be in that column?
TIMOTHY CHIAPPINI: Again, this is a timeline report, therefore there's a variety of data sources contained within it. There is chats or messages that occur from the user of the device to other people, and those parties would be listed within the chat, otherwise known as a group message.
MS. SPRAGUE: So if it was a text message, the direction would say incoming or outgoing, and the party would say who the text was to or from?
TIMOTHY CHIAPPINI: It would say who the participants are on the conversation.
MS. SPRAGUE: So if it's one person you're texting, it would have that person's name, but if you're in a group text, it would have all of the names?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: And then what about the description box?
TIMOTHY CHIAPPINI: Description box is based on the database information. It has some information associated with the actual data that was parsed by Cellebrite. It also provides the source file. The source file is the database that Cellebrite parsed the data from. Everything that you see as far as activity sensor data or any other categorizations, that's done by the software. The software parses that data to make it more readable for the examiner, but everything is associated with an actual database within the device.
MS. SPRAGUE: And so, for example, where it says source health, that's coming from the health section of the phone?
TIMOTHY CHIAPPINI: Specifically the health database, health DB.
MS. SPRAGUE: And where it says source file Lindsay's, how does that name populate there for source file?
TIMOTHY CHIAPPINI: Indicating that it comes from Lindsay's iPhone. That is the name that the software detects from the name of the device when it conducts the extraction.
MS. SPRAGUE: Where... The box for party, if it's a phone call or a text message and it has a person's name in there, say I text you and your name is there, how does that populate? How does your name get into that box? Is it something that the phone gets from incoming information, or is it something that's in my phone?
TIMOTHY CHIAPPINI: The tool is only able to take the information that is present on the device at the time. In order for a contact to be in a phone, it would have to be entered by the user.
MS. SPRAGUE: So would it be whatever I name your phone number is what will show up in the party?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: So if I have, say, my mother's phone number in there, and I say mom for her contact information, it will show up as mom?
TIMOTHY CHIAPPINI: The software will show up the—well, she'd display the phone number and the contact name that was detected by the tool from the extraction.
MS. SPRAGUE: So if I've put a contact in mom and the phone number, the phone number will show up and mom?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: Can you search within this PDF?
MS. SPRAGUE: And do you do that by clicking on the search bar there at the top?
TIMOTHY CHIAPPINI: Yes. This is Microsoft Edge, and that is the proper method within this application.
MS. SPRAGUE: And so if we were to search, for example, McLean...
TIMOTHY CHIAPPINI: I'm not sure of the spelling.
MS. SPRAGUE: There we go. Sometimes it takes a second to populate?
TIMOTHY CHIAPPINI: It does. It's a large document. It's—as I said, it's seven hundred and sixty-eight pages, so depending on the machine that you're using to conduct your analysis, it could take some time for the document to load.
MS. SPRAGUE: Okay, and do you use these arrows here, up and down, to go to each spot that that word is located?
TIMOTHY CHIAPPINI: Correct. The application, Microsoft Edge, has detected four entries for the spelling that is in the search box, and you can navigate to each of those four entries by using those arrows.
MS. SPRAGUE: So for example, here at message six nine five one, it says it's an instant message. It's outgoing, meaning it's going out from Lindsay's phone?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: It's on December twenty-first, twenty twenty-two at two fifty-seven PM, correct?
TIMOTHY CHIAPPINI: Yes, Eastern Time.
MS. SPRAGUE: And then it says from Lindsay, owner, to Allison, correct?
MS. SPRAGUE: So that indicates that it's a text message from Lindsay to someone named Allison, correct?
TIMOTHY CHIAPPINI: Yes, with the corresponding phone number.
MS. SPRAGUE: And then here where it says 'more of a general depression mental health program like at McLean Hospital,' is that the body of the text message that would've been sent from Lindsay's phone to Allison?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: And you can search through the PDF for whatever term you're looking for, whether it be Patrick or medications or anything that you're searching for. It will populate any text messages or searches about those keywords?
MS. SPRAGUE: If we could have the next one, please. Did you also do a report regarding things that were downloaded onto Ms. Clancy's phone?
MS. SPRAGUE: You can look here. Is this that report?
TIMOTHY CHIAPPINI: Yes. Again, this is a supplemental report created within the Physical Analyzer analysis tool from Cellebrite.
MS. SPRAGUE: And what is this report showing us?
TIMOTHY CHIAPPINI: A singular item from the documents section of the project tree, or otherwise known as the analysis component of Cellebrite Physical Analyzer, and it's one single document.
MS. SPRAGUE: And do you just... This blue hyperlink here at the top, twenty twenty-two, ten, twelve fifteen twenty-eight, is that what you click on to access the document?
TIMOTHY CHIAPPINI: Yes. When you create a supplemental report within Physical Analyzer, it... When it creates the PDF, if it has an attachment associated with it, that attachment will be in a separate folder within the report. That way when you click on the actual hyperlink, you're brought to the physical document itself.
MS. SPRAGUE: And for example, in this report, there was a request for medical leave form that was downloaded to the defendant's phone?
MS. SPRAGUE: If we could go to the next one, please.
MS. SPRAGUE: What are we seeing here in this report from December 26th, 2022 to January 24th, 2023? Is this the same type of search for any information and data on the phone during that time period?
TIMOTHY CHIAPPINI: Again, a timeline report is a chronological report of a sequence of events on the device, and it has the same categories as the previous exhibit. And here, the first item within the date parameters happens to be a calendar entry.
MS. SPRAGUE: And so if we go here to page 846 of the document, can you explain for us here, these are... Is this web history, website visits that are documented on the phone?
TIMOTHY CHIAPPINI: That's one of the categories listed as an artifact. The items shown here on the screen are all associated with web browsing.
MS. SPRAGUE: And here where we see 10773 and 10774, and they both state, "Can you treat a sociopath?" Those are two entries that have basically the same search term, correct?
MS. SPRAGUE: And that was on January 20th, 2023?
MS. SPRAGUE: And they both say 8:28 to 8:29 PM. So is it possible to do two searches at the same time like it is displayed there?
TIMOTHY CHIAPPINI: The Cellebrite Physical Analyzer tool parses the information in ways that the information could be categorized in a multitude of ways. Simply because there is more than one entry does not mean that something was done more than once. It's simply just a category that Cellebrite has identified. You could have an item that's in searched items because that's what the tool has identified as a searched item. Also, within web history, as in the search item occurred within the web history, does not necessarily mean that it was done more than once. It's the job of the examiner to be able to look at the timestamps and the associated databases to determine, is this more than one entry or the same action just categorized in multiple ways?
MS. SPRAGUE: And when reviewing Ms. Clancy's phone, did you see numerous occasions where it looked like something was searched multiple times, but it all had the same exact timestamp?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: And so what you just testified to, to make sure I'm understanding it, would it be accurate to state that one search could be documented and located in many different areas of the phone?
TIMOTHY CHIAPPINI: It could be parsed in multiple ways by the analysis tool.
MS. SPRAGUE: So basically categorized?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: So it's one search that's categorized as multiple different things.
TIMOTHY CHIAPPINI: That's possible.
MS. SPRAGUE: And so here where we have the search at the exa- assuming that time down to the second, that appears to be one search for "Can you treat a sociopath?" Not two, correct?
MS. SPRAGUE: We can go to the next one, please.
MS. SPRAGUE: Now, this area here, this separate report, is this the notes that were found on Ms. Clancy's phone?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: And if we could zoom in on that, please.
MS. SPRAGUE: And it's basically detailed in journal form, correct?
MS. SPRAGUE: Starting October 24th, 2022 and moving down, correct?
TIMOTHY CHIAPPINI: The summary portion that you just pointed to is automatically generated by the application when it reads the first few lines of text. The more relevant date is in the column to the left.
MS. SPRAGUE: So over here where it says created October 25th, 2022, that's when the note is first created?
TIMOTHY CHIAPPINI: That is the date that's detected by the analysis tool from the operating system of the device.
MS. SPRAGUE: What does modified mean?
TIMOTHY CHIAPPINI: That's the date that was detected by the forensic tool, and the last time that this note was modified according to the operating system.
MS. SPRAGUE: Modified meaning it was changed in some way?
MS. SPRAGUE: And so if I start a note in my phone on October 25th, and I go in there multiple—every day and change it, and the last time I change it is November 3rd, will it show every modification or just the last modification?
TIMOTHY CHIAPPINI: The only date timestamp that will show is the last modification. Unless the forensic tool is able to categorize each time the note was changed, I'm only able to detect the modified timestamp or last modified timestamp and just the entirety of the note.
MS. SPRAGUE: And, excuse me. You don't know how many times this note was modified, correct?
TIMOTHY CHIAPPINI: Based on this forensic tool and this artifact, no.
MS. SPRAGUE: Can you tell what within the note was changed?
TIMOTHY CHIAPPINI: I cannot.
MS. SPRAGUE: So everything could have been the same and maybe a date changed, or there could have just been a date and everything was changed on November 3rd. You just don't know.
TIMOTHY CHIAPPINI: There could have just been a one character change on the last modified date. But with this forensic tool, and this artifact—
MR. REDDINGTON: What's the date?
MS. SPRAGUE: November 3rd.
MR. REDDINGTON: Thank you.
MS. SPRAGUE: And if we could just scroll down to the October 25th entry. And I would just like you to read this portion of the note. I would read it, I'm sorry, but having some difficulty.
MS. SPRAGUE: Read it.
TIMOTHY CHIAPPINI: "I'm sad and depressed because I am not able to parent my third child like my first. I want to treat any one of my babies like my first, but I know that's not a feasible possibility." I'm sad that I stopped breastfeeding. I feel not as connected with Cal now. I think I sort of resent my other children because they prevent me from treating Cal like my first baby, and I know that's not fair to them. I know that. I was feeling so depressed last evening when Cora and Dawson came home from school. I know it runs off on them, so we had a pretty rough evening. I want to feel love and connection with all my kids. I'm also probably having a bit of an internal conflict because my whole life I've wanted to have a lot of kids. I still don't want Cal to be our last, but I have a lot of figuring out to do before I have another. I'm on the fence about starting a new medication for anxiety/depression. I just want to feel happy. I want to be able to relax and take care of my kids. And then when they go to bed at night, I want to deeply relax and hang out with Pat, and then fall into a deep sleep for eight hours, get up, and pour heart into myself for an hour and a half. Cal was so very planned and desired. I want to be able to give him all the love he deserves. I guess that's what it's like to be the third child, though. He's not the first third child to ever exist. I think I know he'll be okay, but it's really hard for me. I hate that he has to put himself to sleep. I'm sad I'm not breastfeeding anymore, but I think deep down these are the right choices.
MS. SPRAGUE: If you could continue.
TIMOTHY CHIAPPINI: As for the sleep training, I needed a baby that slept through the night because I simply do not have the opportunity in my life to catch up on sleep. I just don't. If there was a time for me to nap every day, then that may not have been the case, but there really isn't. When Cal naps, I have to take care of Cora and Dawson. That's just how it is. It feels cruel to me that we did not do that to Cal, but the reality is we did what we had to do. I guess I also feel slightly traumatized by the sleep training, but that feeling was only really present when I was severely sleep deprived and paranoid. I know what we did was the right thing and okay. As for the breastfeeding, it kind of goes hand-in-hand with the sleep training. Once he started sleeping most of the night, it was then a daily struggle to keep up my milk supply.
TIMOTHY CHIAPPINI: I was having to take a ton of supplements and constantly think about eating and drinking enough to keep the supply up, and then I was having to think about pumping extra to keep it up, and that was really hard to do with Cora and Dawson around. When I tried to leave Cal to go out with Cora and Dawson, I was stressed about the pumping, and not to mention the fact that Cal was at home and not taking a bottle, so it was a battle of it, of if I should pump or not.
TIMOTHY CHIAPPINI: I know I did the right thing because I need to be able to leave Cal with someone and get fed. As much as I don't want to leave him, I need to be able to. I need to be able to be present with my other kids. I still really, really want a fourth child, but I need a really good therapist before then. I'm on the fence about starting a new med or not. I want to feel happy, but it would be nice to feel authentically happy and not fake. But I need to feel happier than I did last evening, 'cause then I was pretty depressed and not enjoying any of my children. It was really sad. I needed the breastfeeding off of my plate. I'm struggling so hard because I wanted to parent each of my kids like my first, and since I can't, that's depressing to me. This is definitely the root cause of all our problems. Now I feel like I'm not parenting any of my kids the way I want to, and that makes me sad too, but I'm going to try my best today.
TIMOTHY CHIAPPINI: Things I love doing that help me love and appreciate and enjoy my kids are activities with them. I definitely started having some depression after Cora, but once I started getting up and out with her, I felt much better. I think signing Cal up for baby music class would be a great thing. Maybe Fridays can be my day with him. I've just fallen out of the habit of doing anything fun, anything for myself, anything with Pat, and I need to work on that. On a positive note, I had a great, deep night of sleep. I'm terrified of something happening to my kids or doing something wrong to mess up their development. Our generation is inundated with information about every aspect of parenting and everything that go wrong if you don't get it right, and all the scary things happening in the world. It's insane. For the last five years, I've just filled my mind with all things parenting, and it's just unhealthy.
MS. SPRAGUE: Thank you.
MS. SPRAGUE: And so everything that you just read would have been written and filled in by the user, correct?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: If we could go to the next one.
MS. SPRAGUE: This is another note, is that correct?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: And this note, it says it was created December 22nd, 2022, but then it was modified on January 23rd, 2023, correct?
MS. SPRAGUE: And this note here, again, we don't know how many times it was modified. You just know the last date it was modified, correct?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: And you don't know what was changed in the note. You just know that something was.
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: Okay. If we could go to the next one.
MS. SPRAGUE: Now, in this report we're seeing some photographs. Is that correct?
MS. SPRAGUE: And why did you flag these photographs?
TIMOTHY CHIAPPINI: The photographs had multiple modification dates relevant to the investigation.
MS. SPRAGUE: How so?
TIMOTHY CHIAPPINI: The photographs have a created, modified, and accessed date that are all the same. However, the metadata indicates a much earlier time.
MS. SPRAGUE: What is metadata?
TIMOTHY CHIAPPINI: Metadata is data about data. An image is data, and with the Cellebrite Forensics Physical Analyzer tool, you're able to see the data about—in this case, an image. Metadata would be the device used to capture the image. It would be potentially, based on the user settings, location data associated when the image—where the image was when it was taken. Excuse me, where the device was when the image was taken. A lot of times it'll tell the size of the image or the type of image file that it is.
MS. SPRAGUE: And so basically, when you look at the metadata of a photograph, you can tell what device was used to take it and the date that the photograph was taken on?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: And can you also tell if that photograph has been changed or modified in any way, and when it was changed?
TIMOTHY CHIAPPINI: Using the forensic tool, I can make inferences based on certain modifications.
MS. SPRAGUE: And how do you do that?
TIMOTHY CHIAPPINI: In this case… the image here is a .JPG. That's the file type of this image. Therefore, I know that the image that I'm seeing is created, modified, and accessed on this date. However, it has a capture time of November 2nd, 2022, at 11:27:15 AM.
MS. SPRAGUE: And is there something on here that says when it was modified?
TIMOTHY CHIAPPINI: Where the cursor is now, it indicates the modification date.
MS. SPRAGUE: So above it is when it was created, below it is when it's modified? Or no, down here, capture time in the metadata is when it was initially created, correct?
TIMOTHY CHIAPPINI: Correct. And you look at the source file, you can see the source file indicates that the image was modified under the component where it says adjustments.
MS. SPRAGUE: So just for the jurors looking at this report, here in the metadata, capture time is when the photo was taken. Above it, the 1/23/23, that's the date that the picture was changed in some way?
MS. SPRAGUE: And are you able to tell how the photograph was changed?
TIMOTHY CHIAPPINI: I can do analysis based on an image and see that an image from its native format was modified.
MS. SPRAGUE: So basically, if I'm on my phone and looking at photos and I brighten something or I crop something, crop someone out of a photo, that would show it as being modified?
TIMOTHY CHIAPPINI: It would show it as being modified. In this instance, it created a new file, which is why it has the created and modified date being the same.
MS. SPRAGUE: And so would it be accurate to state that on this type of phone, when you modify a photo, you can change that photo and leave it there changed, or you can create a new image with that changed photo?
TIMOTHY CHIAPPINI: With an iOS device, Apple has the capability of taking what's known as a live photo. It's a proprietary name with Apple. But the exact file type is HEIC file. HEIC stands for high efficiency image container. An HEIC or a live photo's essentially that. It's a container or burst of images that are taken over a very short period of time. It's a more effective way to store an image file within a device. Takes up less room. It also allows the user to have a multitude of pictures to choose from at a single point in time. If you modify an HEIC image to be a singular photo, you can save it to the file type known as a JPEG or JPG.
MS. SPRAGUE: So a live photo is one of those photos that's taken, and you see a little movement before it settles into the photo when you look at it?
TIMOTHY CHIAPPINI: Yes, ma'am.
MS. SPRAGUE: And is that an automatic setting on iPhones, that it's set to live and you have to change it if you don't want that feature?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: And so if you modify the photo and save that photo, that modification, that modified photo is not live?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: And is that what you saw here? There were a lot of photographs of the children that were accessed and modified in some way?
MS. SPRAGUE: And during what timeframe were these photographs accessed and changed?
TIMOTHY CHIAPPINI: During the evening hours of January 23rd, 2023.
MS. SPRAGUE: Okay. If we could go to the next, please.
MS. SPRAGUE: And what is this report displaying?
TIMOTHY CHIAPPINI: This is another timeline report, with the first event starting January 24th, 2023, at 4:00 PM.
MS. SPRAGUE: And does it go, on January 24th, 2023, from 4:00 PM to 8:00 PM?
TIMOTHY CHIAPPINI: That's correct. Well, it encompasses everything that would be before that timeframe. It appears the last entry is 7:02, 01 PM.
MS. SPRAGUE: And this would contain all of the things that were done with the phone between 4:00 and 8:00 PM on January 24th, 2023. Is that correct?
TIMOTHY CHIAPPINI: Everything that was detected by the forensic tool based on the extraction type.
MS. SPRAGUE: Okay. And if we could go to the timeframe, 4:30 to 4:35.
MS. SPRAGUE: Miralax. Using the tools, search Miralax. Looking here, starting at item thirty-seven at four forty-six PM, is there a search for Miralax for kids on the phone?
MS. SPRAGUE: And again, we're seeing this, the search for Miralax for kids, four forty-six, fifty-five, four forty-six, fifty-five, the same time over and over again. Is that another example of one search showing up in multiple categories?
TIMOTHY CHIAPPINI: Correct. As an examiner, I would be looking at the timestamp and also the category, second box in from the left, indicating that the Cellebrite software has parsed it in multiple locations.
MS. SPRAGUE: If you could slide three,
MS. SPRAGUE: Please. In searching 3V in the document, we see here multiple sources. If you could do a search with the number three, please.
MS. SPRAGUE: So we see here at four forty-three PM on January 24th, a search for the 3V menu, correct?
MS. SPRAGUE: And if we could scroll down a little. And again, those are all at the same time, so they indicate one search for the menu?
TIMOTHY CHIAPPINI: Yes, and the tools parsed it in multiple categories.
MS. SPRAGUE: And if you could go back.
MS. SPRAGUE: Was there also a search for an Apple Maps for 3V?
MS. SPRAGUE: And what time was that?
TIMOTHY CHIAPPINI: I'm sorry, there's a glare.
MS. SPRAGUE: If we could go to four thirteen PM.
MS. SPRAGUE: And here in Apple Maps, do we see 3V restaurant at four thirteen PM?
MS. SPRAGUE: And...
MS. SPRAGUE: When you're using a map feature to look up a location such as Apple Maps, what type of information do you learn when you plug in a location or an address into Apple Maps?
TIMOTHY CHIAPPINI: A route preview.
MS. SPRAGUE: And does that route preview give you a length of time it would take to travel to that location?
TIMOTHY CHIAPPINI: Depending on what you indicate as your originating location, yes.
MS. SPRAGUE: And so if you plug in 3V restaurant to Apple Maps, and it maps out a route to get there, does it tell you from your location to 3V how long it would take to get there?
TIMOTHY CHIAPPINI: Based on traffic conditions, yes.
MS. SPRAGUE: Because that changes constantly, correct?
MS. SPRAGUE: So if I open up my Apple Maps, and I put in 3V right now from here, at this time, the time it takes to get there might be different than, say, at six o'clock tonight.
MS. SPRAGUE: And so if we can look, go to four forty-seven PM.
MS. SPRAGUE: And here at four forty-seven PM, again, we're seeing the search for Kids Miralax, correct?
MS. SPRAGUE: Is there also a visit to a CVS website here at four forty-seven O four?
TIMOTHY CHIAPPINI: Yes. It's categorized in multiple categories within the tool, but it parsed an artifact at that time.
MS. SPRAGUE: If you could scroll down a little, please.
MS. SPRAGUE: To the phone call, the next phone call right here. This outgoing phone call at four forty-eight twenty-one to seven eight one five eight five six five eight one, did you learn that was a phone call to the CVS at one eighty-nine Summer Street in Kingston?
MS. SPRAGUE: And so that would be an outgoing phone call from the defendant's phone to CVS.
MS. SPRAGUE: Can we go to 4:53 PM, please?
MS. SPRAGUE: And then there's a message. It says, “Message 80 outgoing from the defendant's phone at 4:53:09 from Lindsay to Patrick Clancy,” correct?
MS. SPRAGUE: And it says, “Any chance you wanna do takeout from 3V? I didn't cook anything. It's been a long day,” correct?
TIMOTHY CHIAPPINI: That's the content of the message.
MS. SPRAGUE: Is there a response in message 82 from Patrick to Lindsay?
TIMOTHY CHIAPPINI: Yes, there is.
MS. SPRAGUE: And what is the answer?
TIMOTHY CHIAPPINI: Yeah.
MS. SPRAGUE: And then is there a response from Lindsay to Patrick at eight, message 84?
MS. SPRAGUE: And what is that?
TIMOTHY CHIAPPINI: Okey-dokey.
MS. SPRAGUE: And then message 86, again from Lindsay to Patrick, does she send him another message?
TIMOTHY CHIAPPINI: She does.
MS. SPRAGUE: And what does that say?
TIMOTHY CHIAPPINI: Check the menu when you can.
MS. SPRAGUE: And then if you could scroll down to the next message. Is that message 90 from Patrick to Lindsay asking if Callan just got off?
TIMOTHY CHIAPPINI: It is.
MS. SPRAGUE: And then message number 92, is that from Patrick to Lindsay saying, “Also, what are you getting?”
MS. SPRAGUE: And then 94 at 5:06 PM, is that from Lindsay to Patrick stating, “But it was just a short nap,” in message 96?
MS. SPRAGUE: And then message 97 at 5:06, the 3V menu search.
MS. SPRAGUE: And that source says Safari. Is that a Safari web search for the 3V menu?
TIMOTHY CHIAPPINI: Safari is the default web browser on an iOS device, and iOS stands for iPhone Operating System.
MS. SPRAGUE: So that's a basic search on your iPhone for the 3V menu?
TIMOTHY CHIAPPINI: Utilizing the Safari web application, correct.
MS. SPRAGUE: And then number 98, is that another search for Pedialax?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: Excuse me. Now, both the search for 3V menu and the search for Pedialax are at 5:06:45. How does that happen that there are two searches for two different things at the same time?
TIMOTHY CHIAPPINI: Can you repeat the question?
MS. SPRAGUE: So you have in message 97, you have on January 24th, 2023 at 5:06:45, a search for 3V menu, but at the same date at the same time, a search for Pedialax.
TIMOTHY CHIAPPINI: And what's the question?
MS. SPRAGUE: How does it happen that you have two searches at the same time?
TIMOTHY CHIAPPINI: I would only be able to make an inference from here without having the forensic tool available to me.
MS. SPRAGUE: And what would the inference be?
TIMOTHY CHIAPPINI: That there was more than one tab open.
MS. SPRAGUE: Okay. So on your phone or a computer, when you're doing web searches, you can have multiple pages open, correct?
MS. SPRAGUE: And you can just click on whatever page you wanna open, you can click on, and that'll open up?
TIMOTHY CHIAPPINI: Correct. You can select which tab you want within the Safari application.
MS. SPRAGUE: The tabs, right. Okay. So, you... How many tabs can you have open at any one time?
TIMOTHY CHIAPPINI: I'm not sure the number, but I've seen iOS devices capable of having more than 30 or 40 tabs open at a time.
MS. SPRAGUE: So it wouldn't be uncommon or unusual to have at least two open to two different web searches?
MS. SPRAGUE: Okay.
MS. SPRAGUE: If we could scroll down a little, please.
MS. SPRAGUE: And then we have in 106 and 105, both messages. First 105, we have a web history at 5:06:47. The menu at 3V, the restaurant, again, the source Safari. And then we have cookies at 5:06:48, .3Vrestaurant.com. Can you tell us what the difference between those two are?
TIMOTHY CHIAPPINI: They're both from different databases. They're both associated with web browsing. Web history is from the history component of the Safari application. Cookies are installed through web browsing, through legislation. When you visit a website for the first time, you'll typically be prompted, "Do you want to allow the website to download cookies onto your device?" Cookies download on your device, serve a multitude of reasons. One might be that it allows the website or the company to be able to track your activity while on their website, which helps them for marketing and business purposes. Another component of cookies would be to enhance the web browsing experience for a website you go to on a regular basis. It would increase the load time. So it is an artifact that is indicative of web browsing.
MS. SPRAGUE: And so, message 108, again, we have at 5:06:49, we have a message from Patrick to Lindsay saying, "Oh, okay." Is that correct?
MS. SPRAGUE: And then, message 112, we have a message from Lindsay to Patrick where she says, "Mediterranean power bowl," correct?
MS. SPRAGUE: And then—and that was at 5:07 PM. We have message 115 from Patrick to Lindsay at 5:08 PM. "Okay, I'll do scallop and pork belly risotto." Is that right?
MS. SPRAGUE: All right. And then if we could go to 5:10 PM, the phone call right there. Oh, go back one. And so we have two phone calls here, one at 5:09 PM and one at 5:10 PM. The first to 508-747-4950, and the other to 508-927-4046. The first one is for 11 seconds, correct?
TIMOTHY CHIAPPINI: That's the duration, yes.
MS. SPRAGUE: And that's noted here above source?
MS. SPRAGUE: And then the second is 47 seconds. Is that correct?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: Did you look into these two phone calls?
TIMOTHY CHIAPPINI: I don't recall.
MS. SPRAGUE: Okay. Do you recall the 508-927-4046 being the number for the 3V Restaurant?
MS. SPRAGUE: And if we could scroll down a little bit. Are there further searches at 5:13 PM, starting at number 128 for Pedialax?
TIMOTHY CHIAPPINI: That's correct.
MS. SPRAGUE: And again, we're seeing that same thing with the same time, but multiple different categories that that one search is located in, correct?
TIMOTHY CHIAPPINI: Correct. Single artifact, multiple categories that the tool parsed it as.
MS. SPRAGUE: Can we go to 5:33 PM, please?
MS. SPRAGUE: Oh, I'm sorry. Stop there. Thank you. 146, message 146, a message from Lindsay to Patrick at 5:15 PM, which states, "Pedialax liquid stool softener," correct?
MS. SPRAGUE: All right. And then at 147, we have 5:33:51 PM. Is that a phone call from Patrick's phone to Lindsay's phone?
MS. SPRAGUE: And that has zeros in it for duration. Does that indicate the call wasn't answered?
TIMOTHY CHIAPPINI: It would be an inference.
MS. SPRAGUE: And then going down to 150, we have an outgoing call from the defendant's phone to Patrick Clancy for 14 seconds at 5:34 PM, correct?
MS. SPRAGUE: That means the call lasted approximately 14 seconds.
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: And then the last item there, item 152, that is an incoming call to the defendant's phone from Patrick Clancy, correct?
MS. SPRAGUE: And again, we have zeros here, indicating that the call wasn't answered, correct?
TIMOTHY CHIAPPINI: It's an inference, yes.
MS. SPRAGUE: If I could have these reports that I just went over submitted on this disk as the next exhibit.
MR. REDDINGTON: No objection.
THE COURT: All right. That may be admitted.
MS. SPRAGUE: State's 236.
MS. SPRAGUE: Did you also, looking through the defendant's phone, access the information on the calendar portion of the phone?
TIMOTHY CHIAPPINI: I did.
MS. SPRAGUE: And the calendar portion of the phone, does that have different types of data, both populated by the phone itself and Apple, and then items populated by the user?
MS. SPRAGUE: Could you give us an example of something that would be populated by Apple and not the user?
TIMOTHY CHIAPPINI: A national holiday such as Christmas Day would be populated by the operating system through the web, through the application of Calendar.
MS. SPRAGUE: And then if I'm using my phone and I'm putting in appointments or parties or things I'm going to, that would be something that the user is putting into the calendar?
TIMOTHY CHIAPPINI: Correct.
MS. SPRAGUE: And did you do a report of all the calendar activity for Lindsay Clancy's phone from August 4th, 2022 to January 31st, 2023?
TIMOTHY CHIAPPINI: I did.
MS. SPRAGUE: If I could have this marked as the next exhibit.
MR. REDDINGTON: No objection.
THE COURT: All right, that may be admitted. Ms. Sprague, is this a good time to take the morning break?
MS. SPRAGUE: I just have one more exhibit to put in, and then I would be done.
THE COURT: That's fine.
MS. SPRAGUE: Did you... Oh, I'm sorry. 37.
THE COURT: All right, thank you.
MS. SPRAGUE: Did you also do a report on all the text messages between the defendant's phone and an individual that had been labeled Mommy?
MS. SPRAGUE: And was that for the month of January 2023?
TIMOTHY CHIAPPINI: I did.
MS. SPRAGUE: We move to have these admitted as the next exhibit.
THE COURT: All right, that may be admitted.
MS. SPRAGUE: I have nothing further.
THE COURT: All right. So why don't we take the morning recess at this time. All right? So members of the jury are gonna take a short recess, and then we'll return back to the case.
BAILIFF: All rise.
BAILIFF: Jurors close your notebooks, please.
BAILIFF: Jurors have exited the courtroom.
THE COURT: All right. We'll be in recess on this matter. Thank you.