9.David Britt Dove — Direct/Cross

DAVID BRITT DOVE: My name is David B. Dove, D-o-v-e.

DAVID BRITT DOVE: Yes, sir.

DAVID BRITT DOVE: I'm employed by the South Carolina Law Enforcement Division, also known as SLED. I'm the Lieutenant in charge of the computer crime center. On a day-to-day basis I run -- handle the management of the unit. I assign cases. I do forensic examinations of digital items, investigations. I'm also an evidence custodian with us and handle the validation and accreditation for our unit for ASCLD and ANAB.

DAVID BRITT DOVE: I've been at SLED a couple of weeks short of 11 years.

DAVID BRITT DOVE: I've been in law enforcement a little over 19 years.

DAVID BRITT DOVE: Yes, sir. I do.

DAVID BRITT DOVE: Yes, sir. I am.

DAVID BRITT DOVE: What that means is once we receive an item into our lab we assign it a case number that is unique to our unit. The 70, the first two numbers, represents our unit as far as SLED goes with computer crimes. Next two numbers are the year for the case when it was originally open with our unit. And then the following four numbers are the case number for us. Then you have a dash and another number, which is the item number in that case. Every time we receive evidence in we enter it into the computer. It prints a label. We adhere the label to it. That's how we track evidence in our unit. The green dot on there, once something is processed by us it gets a green dot if it was a successful process. If there is an error or some kind of malfunction with a hard drive, for instance, it would receive a red dot.

DAVID BRITT DOVE: Yes, sir.

DAVID BRITT DOVE: Yes, sir. On September 28th, 2017 Detective Creech with the Lexington County Sheriff's Department had previously contacted me about bringing evidence in on this case. I met him when he came in. There was a large number of items. So we helped him carry the items up from downstairs to our second floor location. While he was there I was speaking with him while the items were being logged in and numbers were being adhered to them. They were also being checked and photographed. Then once the items came in and that was completed, myself and one of the other employees with the unit took the items to the evidence vault and placed them on the shelf in the evidence vault.

DAVID BRITT DOVE: Yes, sir. We would have.

DAVID BRITT DOVE: No, sir.

DAVID BRITT DOVE: It was logged in on September 28th, 2017 at 10:13 a.m.

DAVID BRITT DOVE: Yes. After that point, after it came in -- like I said, it was a large number of items that were logged in. So after they were logged in the items were taken in place in the evidence vault on the shelf at approximately 10:40 on September 28th, 2017. Because of the items, I began processing some of the computers in the case. And then on October 13th, 2017 at approximately 13:31, 1:31 p.m., I removed this item from the evidence to begin processing it. Once I got through processing it on the same date, October 13th at approximately 3:48 p.m., I returned it to the evidence vault.

DAVID BRITT DOVE: We reclosed it. Yes, sir.

DAVID BRITT DOVE: Yes, sir. I did.

DAVID BRITT DOVE: Yes, sir. I performed -- was able to perform a logical examination of the cell phone. I was not able to get a physical examination at the time.

DAVID BRITT DOVE: Cellebrite is a software and hardware device that can be used to extract things from tablets, cell phones. You go in and it decodes a lot of the apps that you have on your phone. A lot of the information. It'll extract that information. It doesn't just strictly read only form, so that it can't put information back on the phone. Such if I wanted to type a cell phone number in there I couldn't do that. It'll pull that information off and produce it in a report. A logical is basically what you can pull out your phone and look at and see on it right now. Whereas a physical you can get deleted items. Things that you may not be able to see, you thought you deleted are still in memory. And sometimes it'll also give you additional file system information.

DAVID BRITT DOVE: Yes, sir. I did.

DAVID BRITT DOVE: After I return it back on October 13th to the evidence locker, on July 30th, 2018, pursuant to request from the Prosecutor's Office and Defense in this case, there was a Defense expert that came to our office and the phone was signed out to him. At that time he took it and he performed whatever examinations he was going to do on it, research on it, and then he signed that back in on July 31st, 2018 to us at approximately 12:47 p.m.

DAVID BRITT DOVE: Jake Green.

DAVID BRITT DOVE: No, sir. What happens when we have a Defense expert come to our unit for any case, because we never know if there's potential for contraband, and to also maintain the integrity of it, they will come, they sign it out from us in our unit. Now, our unit is a controlled environment. It has key swipe to get in. And the only people that are allowed in are SLED employees between 8:30 and 5:00, Monday through Friday. Outside of that 5:00 p.m. or before 8:30 the only people that are allowed into the unit are myself, the other employees of the unit and command staff are able to get access, except during an emergency situation, the fire department. So once he came in and signed it out from us he would have gone around the corner to a cube that we have set up with just a monitor and it has a cabinet that has a key in it and it has power in the key. He would have been able to set his equipment up. Once he sets his equipment up he can begin his processing. If for any time whether it's him or another expert needs to leave for the day, or they want to take lunch or go to the restroom, that cabinet they're able to use, they are able to place the item in there, close it, lock it, take the key with them when they leave. And then when they return they're able to unlock it and continue the process.

DAVID BRITT DOVE: He returned it to me July 31st at 12:47 p.m.

DAVID BRITT DOVE: Yes, sir.

DAVID BRITT DOVE: I took it then -- he signed that out along with several other items. So I took all the items and placed them back into the evidence vault on July 31st, 2018 at 12:52 p.m.

DAVID BRITT DOVE: Yes, sir. It was in the evidence room.

DAVID BRITT DOVE: With this item it was signed out November 26th, 2018 at 2:11 p.m., and it was signed out to Detective Phipps with the Lexington County Sheriff's Department.

DAVID BRITT DOVE: Yes, sir.

DAVID BRITT DOVE: Yes, sir.

DAVID BRITT DOVE: He may have -- I believe he does have that, but there's also other software out there that can be utilized.

DAVID BRITT DOVE: Thank you. (Whereupon, the witness stepped down from the witness stand.)