1.Ian Whiffin — Direct/Cross/Redirect/Recross

IAN WHIFFIN: I would rather affirm, I do.

IAN WHIFFIN: Good morning.

IAN WHIFFIN: Yes, it's Ian Whiffin. I-A-N W-H-I-F-F-I-N.

IAN WHIFFIN: At Cellebrite.

IAN WHIFFIN: Cellebrite is a digital intelligence company, working in the digital forensics field.

IAN WHIFFIN: Since 2020.

IAN WHIFFIN: I'm currently a customer engagement manager.

IAN WHIFFIN: I work with customers, helping users of our tools to understand the digital evidence that they're finding and presenting.

IAN WHIFFIN: Any information which is extracted from a cellphone, primarily, or from a computer, which can be interpreted by the examiner and presented as evidence. It could be call history, messages, location data, media, anything that you can find from a digital device.

IAN WHIFFIN: Yeah. I've worked in IT for many years. In 2013, I began my career within Calgary Police Service in Canada as a digital forensics examiner. That was after spending approximately nine or 10 years working as a patrol officer in the UK and in Canada. As part of my role as a digital forensics examiner within the Calgary Police, I went on numerous training courses. The Canadian Police College, they did a introductory course into digital forensics, and then further courses focusing on mobile data provided by some vendors such as BlackLight or Cellebrite at the time, as well as further courses presented by the Canadian Police College, specifically about cellphones.

IAN WHIFFIN: Yes. There are several tools within our catalog. One of them is designed to extract as much data as possible from a cellphone. And then one of the other tools is designed to take that extracted data, decode it, decrypt it, make sense of it, and provide it to the user in a way which can be searched, filtered, organized, reported, and presented.

IAN WHIFFIN: Yes. There's constantly changes being made to devices which make it difficult to extract the data. There are changes being made to the software that means that the data that we extract is now different to the data that we extracted previously. A new feature, for example, or a change that's made by the software developer. So we're constantly changing our software to be able to extract that data and to decode more data.

IAN WHIFFIN: I was, yes.

IAN WHIFFIN: Apple Health is a component of the iOS operating system, which logs sensor data from multiple locations. So there's sensors built within an iPhone that monitor steps taken, flights climbed, for example, as well as third-party devices, Apple Watches, Fitbits, any other device like that. All the information is brought into the Apple Health application, aggregated, and made available for the user to see.

IAN WHIFFIN: Since around 2013, well over 1,000 phones.

IAN WHIFFIN: The analysis is part and parcel. So of those 1,000 phones or so which I've extracted, I've done analysis on all those phones as well.

IAN WHIFFIN: Correct. Yeah. Whenever I'm helping customers, or users of our tools, they may provide me with the extracted data. So the data which I'm analyzing is more than the devices I've extracted.

IAN WHIFFIN: Yes. I've testified in multiple courts around the world, approximately 28 times.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Typically, when I'm working a case, I don't want to know a lot of detail. I'd rather come to my own conclusions based on the data that I'm viewing rather than, you know, know the intricacies of the case. All I require is an outline, the date that something happened, the time, who was involved, basic information.

IAN WHIFFIN: That's what's called a full file system extraction. It's essentially all of the data which has been extracted from the device that is still live.

IAN WHIFFIN: Yes. There's the Cellebrite Physical Analyzer tool, created by Cellebrite and also my own tooling, applications I've been working on for several years.

IAN WHIFFIN: Correct. There's some tools that I've been working on since prior to joining Cellebrite, tools that as an examiner I decided that I needed to create for myself, and make available to others. And I still use those tools to this day.

IAN WHIFFIN: Yes. The primary point of the tool is to go into the data, decode it, provide it in a way which is easy to filter and search, but also additional tools there that allow you to dig into the data and look at the raw information, the databases, the files, all of the raw information, which is what our tools initially decode.

IAN WHIFFIN: Primarily I knew that the date of the incident was the 24th of January, 2023, so that was the main focus of my analysis. But some of the data I was aware could be from further afield than that, so I took a look of, I think it was around three weeks before that, so early January to late January.

IAN WHIFFIN: I was, yes.

IAN WHIFFIN: The user of the phone would be able to access the health data via the health application, where the information's broken down to explain how many steps have been taken over a particular period of time, the approximate distance that was traveled, the number of stair flights that were climbed. That data is stored on the device itself in a database. So as a forensic examiner, I can take a look at that database in its raw form, understand exactly where that information's coming from, and present it to the user of our forensic tools in a slightly more forensic-friendly method than the user of the application on the phone would see.

IAN WHIFFIN: Correct.

IAN WHIFFIN: So heart rate data comes from wearing an Apple Watch or a similar device, not from the phone itself. In the case of this phone, there was an Apple Watch paired to the device, and all of the heart rate data, which is recorded periodically throughout the day, is stored within the health database.

IAN WHIFFIN: So as it says in the third paragraph down, the Apple Watch itself was called Lindsay's Apple Watch.

IAN WHIFFIN: There are sensors on the Apple Watch itself on the rear, which periodically check the heart rate at any given time, and that information is sent to the phone via Bluetooth.

IAN WHIFFIN: The actual cadence at which the watch is checking would depend on what the user's doing. So if you were in the middle of a workout, it would be a lot more consistent than just periodically throughout the day. And I actually don't know how often it is throughout the day if you're not doing any particular workout. There doesn't seem to be a set cadence. Every device I've looked at, it's slightly different.

IAN WHIFFIN: Yes. This is typical from what you see when you look at the database. The timestamps are never consistently at a recognizable cadence.

IAN WHIFFIN: So I actually tried to just highlight some of the high points for the day. I realized a few days ago while reviewing this, there was records there that show a high of one twenty-three and one twenty-two, which I'd not highlighted.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Yes.

IAN WHIFFIN: So the last heart rate recorded was at seventeen twenty-three fifty-two, so twenty-three minutes past five in the afternoon, with a heart rate of fifty-seven beats per minute.

IAN WHIFFIN: There was a range of heart rates, going between, as low as, I believe around fifty and as high as around one twenty-two. On average, it was around high eighties, early nineties.

IAN WHIFFIN: Correct.

IAN WHIFFIN: That's correct.

IAN WHIFFIN: If the watch was taken off, if the watch was turned off, uh—

IAN WHIFFIN: …the battery was dead, yes.

IAN WHIFFIN: Flight climb is information which the Apple Health application stores every time it detects that you walk up a flight of stairs. So a flight of stairs would be considered either a three-meter or ten-foot incline at over sixteen steps. So the device has detected that both the altitude has changed by ten feet, and there were steps being walked at the same time.

IAN WHIFFIN: That's correct.

IAN WHIFFIN: The altitude's being monitored by a barometer or an altimeter, which is inside the device, just measuring for differences in air pressure.

IAN WHIFFIN: It is. Both devices have got the barometers built in. Both devices can monitor flight climb events.

IAN WHIFFIN: There are some circumstances where that can happen. They're typically quite rare, but it can happen.

IAN WHIFFIN: Correct. Yes. If there is movement which the device can mistake for steps at the same time as the incline is being driven, then that could accidentally record a flight climb.

IAN WHIFFIN: Correct. If the person is in a house, and there are flight climbs being recorded, then the only rational explanation is that the person was climbing stairs.

IAN WHIFFIN: Within the application or within the forensic tool?

IAN WHIFFIN: Okay. So within the forensic tool, we break down—or within Physical Analyzer, we break down the health data into hour segments. So for an hour, we may say that there are three flight climbs. And then it's up to the user to dig in a little further. They can select that one hour and then see how that activity breaks down over the hour. So you would see that there were two flight climbs that occurred ten minutes after the hour, and then, you know, another flight climb occurred later on.

IAN WHIFFIN: Mm-hmm.

IAN WHIFFIN: Correct. So in this case, the user's looking at a time period between ten AM and eleven AM. And the health data that's been pulled from the database has been aggregated. And it tells you that there's ninety-eight samples being considered. The maximum heart rate during that hour-long period was a hundred and eight. The distance traveled was approximately seven hundred and fifty-nine meters, and there were five flights climbed within that hour.

IAN WHIFFIN: Correct. So this is further down the screen in the interface, where we can see actual time of ten seventeen twenty-seven, where there's two flights climbed. And again, another record at ten seventeen twenty-eight, where there were two flights climbed, and then a further flight climb at ten forty-nine.

IAN WHIFFIN: So you may have realized in the slide above where there was two flight climbs at seventeen seconds past and two flight climbs at eighteen seconds past, that's an unrealistic measurement. It's because one of those measurements comes from the phone and one comes from the watch. This table breaks it down to say which of these records came from the watch and which came from the phone because there are some which overlap.

IAN WHIFFIN: Correct. So if we look at records four and five here, for example, we can see a start time of ten seventeen twenty-seven and an end time of ten to twenty-seven oh-six, where the watch recorded two flight climbs. And then one second later, a start time, and two seconds later for the end time, we see the watch also detected two flight climbs. This is just the same two flight climb events that happened, but both devices recorded those flight climbs with slightly different timestamps.

IAN WHIFFIN: That's correct.

IAN WHIFFIN: I did. I tried to correlate and discard all of the duplicate information. So where there was an event of a flight climb that was recorded on the watch and the phone, rather than provide information that said there was two flight climbs, I would ignore one of them and limit it to just the ones which we could prove happened.

IAN WHIFFIN: Correct.

IAN WHIFFIN: It does. It shows that there was additional flight climb events logged by the phone which were not logged by the watch, at seventeen oh three and seventeen thirty-three.

IAN WHIFFIN: Correct.

IAN WHIFFIN: The way the Apple Health data records this information aggregates it. It tries to group events together. So in this case, it would have recognized that there was a flight climb on the phone at around seventeen thirty-three, thirty-four, and a second one at around seventeen thirty-eight, thirty-three, and it just grouped them both into one event. It doesn't mean that it took five minutes to walk up two flights of stairs. It's just within that five-minute period, there were two flight climbs.

IAN WHIFFIN: Correct. There tends to be around a ten-minute window where it tries to check every ten minutes, but it can reduce that window in a case like this where it sees that there's grouped data within a smaller time period.

IAN WHIFFIN: Correct.

IAN WHIFFIN: I did, yes.

IAN WHIFFIN: For web usage, I expanded the time of interest to early January to the twenty-fourth of January, and just took a look at any web history over that time. There was over thirteen hundred records recovered. I took a cursory look down that list and highlighted some which potentially were relevant to the case and then provided the thirteen hundred actual records as a appendix report.

IAN WHIFFIN: That's correct.

IAN WHIFFIN: That's correct. Broken down by day, with the time of the search, the website that was visited, the title of the webpage, and then the identifier in the database.

IAN WHIFFIN: Correct.

IAN WHIFFIN: If I could see the search, please.

IAN WHIFFIN: Yeah. So, the top entry here we can see starts with https://www.google.com/search, question mark q. The text after the q, "How quickly does Wellbutrin work?" is what the user searched. Typically that is exactly as the user typed it, assuming that there are no auto-completions in place. In this particular case, it appears it was searched using Safari, so there's no auto-completion. That is essentially what the user typed in. And then the title, how quickly does Wellbutrin... Wellbru- I can't say that word, I'm afraid.

IAN WHIFFIN: Wellbutrin, thank you, work for depression Google search is the title of the page which Google assigns.

IAN WHIFFIN: So that's part of the attribute. It's how you... The data's encoded in a URL or in a web search. You can't have spaces within this address string, so they replace the spaces with the plus sum, plus symbol.

IAN WHIFFIN: Yes. It's URL encoding to make it safe for the browser.

IAN WHIFFIN: For... Yes, and depression spelled with a B at the end instead of an N, which demonstrates this is what the user typed in rather than a page that was being visited.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Yeah. Again, those words were typed in by the user.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Yes, the morning.

IAN WHIFFIN: Yes.

IAN WHIFFIN: That's correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: There was.

IAN WHIFFIN: Correct.

IAN WHIFFIN: No. There's no real auditable log to look back and see how many times it's been modified over the course of its life. I was able to do some amount of recovery to see that, on the day it was created, it started in a very similar way to as it's written on the 24th or 23rd of January. But the exact changes between when it first was created and the last time it was modified, we don't know.

IAN WHIFFIN: Correct.

IAN WHIFFIN: I did, yes.

IAN WHIFFIN: Yeah. I tried to prepare it in a report which would be easy for any viewer to understand, based on their own usage of text messaging.

IAN WHIFFIN: Correct.

IAN WHIFFIN: It is. The messages in blue on the right would be outgoing. The messages in gray on the left would be incoming.

IAN WHIFFIN: Correct.

IAN WHIFFIN: I did, yes.

IAN WHIFFIN: Correct.

IAN WHIFFIN: I did, yes.

IAN WHIFFIN: That's meant to be twenty-twenty-three, yes. I apologize.

IAN WHIFFIN: Yeah. The start time of the call, typically when it is answered by the recipient. The end time, when the call's ended. The metadata is information including who the call was to or from, how long the call lasted, and then the reason that the call disconnected, and then a record ID. So if you had the database, you could go in and find this record based on the ID number.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: In this case, it was an unanswered call.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: That's correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Metadata is information about that photograph. It could be the device that captured it, the time that it was captured, the location, information about the lens, the lighting, et cetera.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: The metadata of the photo included the latitude and longitude, where the image was captured. I took that latitude and longitude and looked on Google Maps to see a physical address. In this case, it came down to the South Shore Medical Center.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Device usage would relate to how the user is operating the device. So when they have it unlocked, locked, what application's being used any particular time. Essentially anything which is not a message or a phone call or results in additional data like that.

IAN WHIFFIN: So this table relates just to the locking and the unlocking of the device. So the last time the device was unlocked was at seventeen thirteen sixteen. The device was locked again, around two minutes later at seventeen fifteen twelve, and the device was not unlocked again.

IAN WHIFFIN: There is a setting within iPhones that allow you to use a locked device to call back numbers for missed calls. So in this case, Lindsay had the missed phone call, that would've shown on screen as a notification as a missed call, and without unlocking the device, you're able to call that person back.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Application focus is literally the application which is visible on screen at any given time.

IAN WHIFFIN: At sixty- sixteen thirteen twenty-three until sixteen fourteen fifty, the Apple Maps application was being used, visible on screen.

IAN WHIFFIN: So at five thirteen until five fourteen, it was mobile Safari. So the mobile version of Safari, the internet browser, was on screen, and at seventeen fourteen forty-seven until seventeen fifteen oh eight, it was the mobile SMS or messaging application which was on screen.

IAN WHIFFIN: Correct. What application was on screen at the time.

IAN WHIFFIN: It does. That's the screen indicates you are in a phone call.

IAN WHIFFIN: Yeah. Apple Maps was used to plan a route from the user's current location, the home address, to a restaurant called 3V.

IAN WHIFFIN: It was.

IAN WHIFFIN: Yes. So the last unlock of the device was used for the purposes of viewing Safari, where Pedialax was searched using Google.

IAN WHIFFIN: At the same time, or in that same device usage, so the device was unlocked, Safari was used to search Pedialax, and then the messaging application was opened to send a message to Patrick saying, "Pedialax liquid stool softener."

IAN WHIFFIN: It was.

IAN WHIFFIN: I did, yes.

IAN WHIFFIN: It is, yes.

IAN WHIFFIN: Yes. So the very first column is the timestamp. The next few columns which show, typically colored, is related to the activity, which will become a little bit clearer in a moment. The row or the column in the center explains what the record is. So if, for example, we look at the seventeen thirteen sixteen record, we can see a U, which means the device was unlocked in pink. That unlock event lasted until seventeen fifteen twelve, so hence that entire column is in pink and shows the relevant lock event.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Correct. And then any activity that happened during that unlock time is then shown within the rows between. So again, we see Safari open at seventeen thirteen sixteen. Safari was closed at seventeen fourteen forty-seven. Messaging was opened at seventeen fourteen forty-seven. While messages were open, there was an outgoing message sent for Pedialax. Then messaging was closed. Messaging was opened again, and messaging was closed prior to the device locking. So everything in the colored columns tries to show all of the events that happened at the same time or during that parent event.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Correct. So two flight climbs occurred during that time period.

IAN WHIFFIN: Correct.

IAN WHIFFIN: So "flight climb started" is how it's listed within the database and within the software. But it actually, the flight climb time is when the flight climb has been recognized by the device, as the device has already climbed up those stairs. So even though it says "flight climb started," that's technically the time that the flight climb, or the first flight climb had ended.

IAN WHIFFIN: Yes. That indicates the phone has now realized, 'I'm three meters higher than I was the last time I checked,' therefore a flight climb has already been completed at that point.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Good morning.

IAN WHIFFIN: I've done research on it, yes.

IAN WHIFFIN: It was a rugby field, yes.

IAN WHIFFIN: Correct. It was three phones.

IAN WHIFFIN: Correct.

IAN WHIFFIN: It's the heart rate is on the watch, yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: That's on both the watch and the phone.

IAN WHIFFIN: Yes, the information that's recorded within the Apple Health database does specify whether the information comes from the watch, the phone, or from a different device.

IAN WHIFFIN: It was around that time.

IAN WHIFFIN: Thank you.

IAN WHIFFIN: Yes. The last heart rate was 5:23:52.

IAN WHIFFIN: The last usage of the... Let me double-check this. I believe the last usage of the phone to record flight climb data was at 5:38, yes.

IAN WHIFFIN: Yes, not until, like, the phone was seized by police, I believe.

IAN WHIFFIN: But there's other activity, but appeared to be after the incident.

IAN WHIFFIN: I ended my analysis on the 24th.

IAN WHIFFIN: Again, there would've been activity later on, but it wasn't usage. It wasn't health data. It would've been in things like incoming calls, if there were any.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: If you only have the data on the device, yeah.

IAN WHIFFIN: Mm-hmm.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Apologies. August 23rd, 2022?

IAN WHIFFIN: I didn't go back—

IAN WHIFFIN: ... anywhere near that date.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: It certainly can, yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: The created time?

IAN WHIFFIN: Of 9:30, 34? That'd be when the device decided that the device had visited this location enough to consider it a visit.

IAN WHIFFIN: I don't recognize it from the coordinates.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Yes. Correct.

IAN WHIFFIN: It rings a bell, yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: I have a different page 11.

IAN WHIFFIN: That looks like this page 12.

IAN WHIFFIN: Yes.

IAN WHIFFIN: So this is a revision.

IAN WHIFFIN: The revision submitted in February that just had—

IAN WHIFFIN: … a different record highlighted.

IAN WHIFFIN: Correct.

IAN WHIFFIN: I can.

IAN WHIFFIN: Yes, sir.

IAN WHIFFIN: 12:14 AM, yes.

IAN WHIFFIN: 11:00 PM.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Somebody used the cell phone to Google, yes.

IAN WHIFFIN: Exactly.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: 19:48.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: It does.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Exactly at the moment, I don't have all of that in front of me. It's possible to see snippets, going back over time. I do recall—

IAN WHIFFIN: … on the 22nd of December when this was created, it started with the same sentence.

IAN WHIFFIN: And there was a few, essentially spell check, spelling differences—

IAN WHIFFIN: … as time went on. But as much as you can recover from the earlier versions of the note, it's a snippet. It's essentially two sentences, and the rest of it is—

IAN WHIFFIN: It's essentially the same note.

IAN WHIFFIN: I believe the first few pages are sent to Mommy.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Yes. The blue message is outgoing.

IAN WHIFFIN: Yes.

IAN WHIFFIN: The one on screen at the moment is the response sent from Mommy to Lindsay's phone saying, "That's a big roll of snow. I was wondering if you got enough for the kids to play in, and it's pretty nice day too. Gives them something to do on a day without school."

IAN WHIFFIN: Correct.

IAN WHIFFIN: And this is a conversation with Patrick.

IAN WHIFFIN: So at the very top of that, message above the photograph it says, "Got himself dressed," and that would be the message that was sent alongside the photograph.

IAN WHIFFIN: Initially it was just the photograph.

IAN WHIFFIN: Sorry?

IAN WHIFFIN: I don't remember seeing any response.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: The message at 8:19 AM that says, "Cutie," was sent by Patrick—

IAN WHIFFIN: ...in a different thread to the snowman photographs.

IAN WHIFFIN: Oh, yes. That's the one, from—

IAN WHIFFIN: Correct.

IAN WHIFFIN: And that was—

IAN WHIFFIN: ...at 11:33 AM.

IAN WHIFFIN: "Cutie."

IAN WHIFFIN: Yes, that would be the phone stored as Patrick, sending a message to Lindsay's phone.

IAN WHIFFIN: It appears that Lindsay, reacted to an image, with the love emoji.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Patrick asked, "How's it going?"

IAN WHIFFIN: "Good."

IAN WHIFFIN: Yes. She also responded, "Okay, her urine looked good, so nothing going wrong with her kidneys, phew."

IAN WHIFFIN: That's how I read it, yes.

IAN WHIFFIN: Yeah, yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: 11:29 talking.

IAN WHIFFIN: "You're a good mama."

IAN WHIFFIN: She responds with an emoji, which is the face covered in hearts.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Correct.

IAN WHIFFIN: A full file system extraction.

IAN WHIFFIN: Correct.

IAN WHIFFIN: The appendix one of the Lindsay Clancy phone is 1,300 and some web search visits.

IAN WHIFFIN: Yes. This appears to be the—just the web history from Lindsay's phone.

IAN WHIFFIN: Correct.

IAN WHIFFIN: I did.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Correct.

IAN WHIFFIN: Okay.

IAN WHIFFIN: Yes. I didn't create it, but I recognize the report.

IAN WHIFFIN: May I take a-

IAN WHIFFIN: ... Yes. This is a report generated by Physical Analyzer, a Cellebrite tool, of the device.

IAN WHIFFIN: Sure.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: It would be 9:35, local time in the morning.

IAN WHIFFIN: Yes.

IAN WHIFFIN: So this is for the hour of health data, so it's been aggregated, and it shows that between 7:00 AM and 8:00 AM, there was 47 meters traveled.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Yes.

IAN WHIFFIN: Meters.

IAN WHIFFIN: That's coming from the watch and the phone and being displayed-

IAN WHIFFIN: ... As one amount of information.

IAN WHIFFIN: The way that the data's presented, that is coming from the watch or the phone.

IAN WHIFFIN: Correct.

IAN WHIFFIN: I like to think so.

IAN WHIFFIN: I've created some of the tools, yes.

IAN WHIFFIN: Based purely on the report there, I'd suggest the data came from the phone rather than the watch.

IAN WHIFFIN: No, I— we can't actually pull data directly from the watch. We pull it from the phone.

IAN WHIFFIN: We extract the data from the phone, which is synchronized to the wa— from the watch to the phone.

IAN WHIFFIN: It appears to be, yes.

IAN WHIFFIN: Mm-hmm.

IAN WHIFFIN: I've never seen this before, no.

IAN WHIFFIN: I started looking at this case in November last year.

IAN WHIFFIN: It could've been either device.

IAN WHIFFIN: No. I'd need to take a look at the database itself and see where that information came from.

IAN WHIFFIN: Correct. We don't extract the memory from the watch itself. We extract data from the phone, which is synchronized to the watch. So we ultimately get the watch data from the phone.

IAN WHIFFIN: Apple's proprietary connections, the encryption that they use on the device, complicates extraction. And essentially considering we get everything from the watch via the phone, it's just additional work required to pull data from the watch, which would just be a duplicate of what we already have.

IAN WHIFFIN: Correct.

IAN WHIFFIN: It was.