12.Mike Phipps — Direct/Cross/Redirect (Part 1)
616 linesMIKE PHIPPS, being first duly sworn, testified as follows:
COURT CLERK: Have a seat, sir. Once you're seated state your full name, spelling your last, please.
MIKE PHIPPS: Michael Phipps, P-H-I-P-P-S.
DIRECT EXAMINATION By Mr. Graham:
SHAWN GRAHAM: Mr. Phipps, if you'd pull that microphone and speak louder so the jury can hear you. Where are you employed, sir?
MIKE PHIPPS: With the Lexington County Sheriff's Department.
SHAWN GRAHAM: And how long have you been in law enforcement?
MIKE PHIPPS: Twenty-one years.
SHAWN GRAHAM: And what is your current job title?
MIKE PHIPPS: I work in our forensic services unit as an examiner of digital evidence.
SHAWN GRAHAM: In addition to being employed by the sheriff's department, are you also on a federal task force?
MIKE PHIPPS: I am. The --
SHAWN GRAHAM: Can you explain to the jury what that is?
MIKE PHIPPS: The South Carolina Electronic Crimes Task Force. It's a task force administered by the Unites States Secret Service. They stand this task force up to support state and local jurisdictions in the investigation of crimes that involve digital evidence or digitally facilitated crime.
SHAWN GRAHAM: When I use the term forensic examiner, what does that mean?
MIKE PHIPPS: We examine items of evidence. Cell phones, computers, DVRs, GPS units. Anything that's digital that potentially has data on it that would be relevant to an investigation.
SHAWN GRAHAM: Would you describe to the jury your background, training, education, experience as far as forensic examination of cell phones?
MIKE PHIPPS: I started receiving specialized training in digital evidence in 2005. Since that time, I've received over 600 hours of instruction on various computers, cell phones and other items.
SHAWN GRAHAM: Approximately, how many cell phones have you examined?
MIKE PHIPPS: I don't have a firm count, but it would be a conservative estimate of over 800.
SHAWN GRAHAM: Over how many?
MIKE PHIPPS: Eight hundred.
SHAWN GRAHAM: And have you been qualified as an expert in forensic examination in South Carolina before?
MIKE PHIPPS: Yes, sir. I've been qualified in the area of -- various areas of digital forensics 12 times.
SHAWN GRAHAM: Your Honor, the State would offer Investigator Mike Phipps as an expert in the field of forensic examination.
THE COURT: Any voir dire?
BOYD YOUNG: No objection.
THE COURT: Okay. Agent Phipps is qualified as an expert and may offer opinions in the field of digital forensic examination.
SHAWN GRAHAM: Investigator Phipps, let me show you what's been marked as State's number 91, which is a Samsung Galaxy Note 3, I believe, and ask if you recognize that item.
MIKE PHIPPS: Yes, sir. I do.
SHAWN GRAHAM: Can you explain to the jury -- in previous testimony, we've gone through chain of custody on that item. You would be the last person to help complete that chain and you actually tested it multiple times. So could you step through your contact with the phone with the jury and let's talk about it a one by one.
MIKE PHIPPS: I had several times where I had possession of this phone. The first being back in January of 2015 around 8:00 o'clock in the morning on that date for a few minutes. I had it signed out, and usually when we sign something out for only a brief period of time like that, we're doing it for the purpose of identifying the device, recovering serial numbers off the device so it can be referenced and searched for.
SHAWN GRAHAM: And that was on January 7th of 2015?
MIKE PHIPPS: That is correct.
SHAWN GRAHAM: And you got that from Candy Kyzer from the Lexington County Sheriff's Department?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: And you kept it out for approximately 13 minutes, and then you turned it back to Ms. Kyzer. Is that correct?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: During the 13 minutes that you had it, would you have manipulated or changed any of the data or the artifacts, I think is the term of art that you would use, that were on that phone?
MIKE PHIPPS: No, sir. I did not.
SHAWN GRAHAM: After you returned it back to Ms. Kyzer on the 7th, when is the next time that you came in contact with it?
MIKE PHIPPS: Again later that day, January 7th, at 9:00 o'clock. It remained in my possession until January 22nd when it was returned to Ms. Kyzer.
SHAWN GRAHAM: During that time, again, you got it from Ms. Kyzer on January 7th. Is that correct?
MIKE PHIPPS: That's correct.
SHAWN GRAHAM: And then you turned it back to Ms. Kyzer on January 22nd, correct?
MIKE PHIPPS: Correct.
SHAWN GRAHAM: During that time, did you do a physical examination?
MIKE PHIPPS: I didn't.
SHAWN GRAHAM: You did not. Now, is that a time when, pursuant to a court order, there was another examiner who had access to the phone?
MIKE PHIPPS: Yes.
SHAWN GRAHAM: And once you got that phone back from that other examiner and you returned it back to Ms. Kyzer, when's the next time that you accessed the phone? I think, at this point, the phone --
MIKE PHIPPS: I believe, at this point, the phone was at SLED, if I'm correct.
SHAWN GRAHAM: And I think that would have been on --
MIKE PHIPPS: November 26th, 2018. I picked the phone up from SLED's computer crime center from Agent Britt Dove.
SHAWN GRAHAM: And then the phone was in your possession at that time. And at that time, pursuant to the search warrant, did you do an examination of the phone?
MIKE PHIPPS: I did.
SHAWN GRAHAM: And then ultimately after your examination was done, you returned the phone to Beth Holliman at the sheriff's department on December 4th of 2018. Is that correct?
MIKE PHIPPS: Yes, sir. That's correct.
SHAWN GRAHAM: Two other experts -- well, let me ask you this question. All the artifacts -- when I say artifacts, what's an artifact?
MIKE PHIPPS: An artifact can be just anything that's recovered off the device whether it's a photo, text message or a text file on it. It's just a general term we use for something that's recovered. An artifact or an item.
SHAWN GRAHAM: The examination -- when we talk about an examination, what did you do?
MIKE PHIPPS: We take the device and we process it. In this case, I use a forensic tool by a company called Cellebrite. The device is a universal forensic extraction device or UFED. That is a tool that we use to forensically recover data off the device without changing any of that data.
SHAWN GRAHAM: Can you give an example of what the artifacts are that you're talking about recovering from the phone?
MIKE PHIPPS: There's different ways you can acquire that data. Logical, file system, physical. In this case, we did a file system and a physical acquisition or removal or recovery of the data. That data is then processed later on in other forensic tools to make that data visible or readable to a user. Obviously, like a computer, that data is stored in, literally, ones and zeros on the device and it has to be processed to make it usable for an analyst or some other person that wants to read that data, and it can be anything from photos, text messages. Again, just anything that can physically reside on a phone, you could ultimately recover.
SHAWN GRAHAM: The artifacts that you were able to recover off that phone, did they all appear to be original artifacts created at the time of the event on the phone?
MIKE PHIPPS: Yes, they do.
SHAWN GRAHAM: Are you aware of any way -- are you aware of any type of software or any way to go back and actually create or insert events or artifacts after the fact?
MIKE PHIPPS: I'm not.
SHAWN GRAHAM: There are different types of extractions. Is that correct?
MIKE PHIPPS: Yes.
SHAWN GRAHAM: And I think there are three types. Could you explain to the jury the three different types of extractions there are and what each one of them is?
MIKE PHIPPS: Again, a logical, a file system and physical are the three types. Logical being what you would see on the phone if you were just to browse through the phone yourself. In other words, you go to text messages and you see all the text messages. File system takes it just a little bit further in that it's taking in, potentially, some items that the phone isn't going to display to the user. It's in the file structure of the phone. So, potentially, there could be a database third party application meaning an application that you installed that didn't come with the phone itself. You would potentially see those items in a file system acquisition. A physical is where we bypass the operating system altogether and we acquire the raw data that's stored in memory on the phone or on the flash memory and, again, that's going to be in a binary form, ones and zeros, and it has to be processed to make it viewable to a user.
SHAWN GRAHAM: The extraction that you performed on this phone, what kind of extraction was it?
MIKE PHIPPS: We did both a file system and a physical.
SHAWN GRAHAM: Let me show you what's been marked as State's number 33 for ID, it's a disc, and ask if you recognize that.
MIKE PHIPPS: I do.
SHAWN GRAHAM: And what is that document?
MIKE PHIPPS: It is a disc that I created that has the raw data from both the acquisition, the post-processing, taking that data and running it through a forensic tool that makes it viewable. If I recall, there's also photos of the device itself on here, and then some copies of documentation such as a search warrant.
SHAWN GRAHAM: You had mentioned a forensic tool. Is that a reader? Is that what you're recalling about -- or talking about?
MIKE PHIPPS: Right. There's a software tool, a physical analyzer, again, from the same company, Cellebrite. And then we also use other forensic tools as well. But in this case the data that's on here is straight from physical analyzer and there's a reader that allows you to load up all that data and make it visible, sort through it and do key word searches.
SHAWN GRAHAM: Your Honor, the State would offer 33 for identification as just identification at this time.
THE COURT: It's marked as 33?
SHAWN GRAHAM: Yes, Your Honor. (Whereupon, State's Exhibit number 33 was marked for identification only.)
SHAWN GRAHAM: Investigator Phipps, let me show you what's been pre-marked as State's Exhibit number 77 for ID and ask if you recognize that.
MIKE PHIPPS: Yes, sir. I do.
SHAWN GRAHAM: And is that a document that you prepared from artifacts that were on the Samsung Galaxy Note 3 that we're discussing, which is State's 91, that came from the Cadillac Escalade?
MIKE PHIPPS: It is.
SHAWN GRAHAM: And the time period that that covers is what?
MIKE PHIPPS: August 28th of 2014 at about 7:51 in the morning through September 4th, 2014 at 12:58 p.m. in the evening.
SHAWN GRAHAM: In general, what kind of artifacts does that report reflect?
MIKE PHIPPS: This particular report lists call logs, call history, SMS or text messaging, searches, whether they're various types of web searches and web history.
SHAWN GRAHAM: Now, you would have also had access to emails, as well, right?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: Did the Defendant send out any emails that you're aware of during that time period?
MIKE PHIPPS: We found no outgoing emails during this time period.
SHAWN GRAHAM: Your Honor, the State would offer 77 into evidence at this time. The State would offer it into evidence, Your Honor.
BOYD YOUNG: Subject to our previous objection.
THE COURT: Subject to previous objection and all the pre-trial stuff. Absolutely. Objection's noted. It's admitted. (Whereupon, State's Exhibit number 77 was admitted into evidence).
SHAWN GRAHAM: And, Your Honor, if I could have Investigator Phipps step down and publish this to the jury, Your Honor.
THE COURT: Sure.
SHAWN GRAHAM: For the record, Your Honor, what I've done is, State's 77 that Investigator Phipps has that is in evidence that the jury will see actually has telephone numbers in there. What I'm going to display on the overhead has the telephone numbers blacked out.
THE COURT: Okay.
SHAWN GRAHAM: If a telephone number becomes important we can bring that up in testimony.
THE COURT: Any objection to doing that, Mr. Young?
BOYD YOUNG: No, Your Honor. (Whereupon the witness steps down from the witness stand.)
SHAWN GRAHAM: Investigator Phipps, when you start at the top -- when you start up here at the top, beginning on the morning of August 28th of 2014. Is that correct?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: The first entry you have is at 7:51 a.m. in the morning. Is that correct?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: Was there any other activity as far as -- was there any other activity prior to -- starting at midnight or was that the first activity of the day?
MIKE PHIPPS: That was the first user activity, meaning that someone was interacting with the phone. Obviously, a lot of people leave their phones on, plugged up charging. There can be items that change and update within the operating system. But this was like the first user interaction of doing something on the phone itself.
SHAWN GRAHAM: All right. So the very first thing that we see in the morning at 7:51 a.m. says that it's coming off the call log. In the direction field it says outgoing. What does that mean?
MIKE PHIPPS: It means that someone on the phone was placing the call. It was going to someone else.
SHAWN GRAHAM: Now, the number we discussed that's blacked out on this that's on the copy that the jury will see in evidence, were you able to determine who that number belonged to?
MIKE PHIPPS: Yes. That was -- the number belonged to the Defendant's father, Tim, Sr.
SHAWN GRAHAM: So there was an outgoing call to the Defendant's father, Tim, Sr. And in the description field, there are numbers, what do those numbers mean?
MIKE PHIPPS: It's the time or duration of the call. Minutes and seconds. In this case, four minutes and forty-seven seconds.
SHAWN GRAHAM: The second entry is the same day, August 28th at 12:24 a.m., and it says web history. Will you explain to the jury what web history is?
MIKE PHIPPS: Web history is another one of those categories of artifacts. In this case, it's shown that there was activity detected, internet activity. In this case, specifically to a certain web address, which is listed on my notes.
SHAWN GRAHAM: The next entry is at 3:06 p.m. on that day. Again, web history. Can you tell -- can you tell the site that he accessed?
MIKE PHIPPS: Yes. That was -- would be a Monday morning .com website, Map Quest.com website.
SHAWN GRAHAM: Continuing on the same date at 1:27. Now, what do you see?
MIKE PHIPPS: I see an outgoing call -- or from the call log, it's an incoming call from the call log from the number that is listed in his address book as a Roberta Thornsberry.
SHAWN GRAHAM: So the number -- the contact was on a phone showing Roberta Thornsberry?
MIKE PHIPPS: Right. When there's a name that appears under the party's name, it's pulling that name from his address book. So that's what appeared when the phone rang. In this case, it was an eight minute and fifty-three second call.
SHAWN GRAHAM: The next entry shows the same day, August 28th, 2014 at 5:44 p.m. What artifact did you discover?
MIKE PHIPPS: The music artifact is just that an audio file was accessed at that point in time. And in this case it was an MP3, which is a playable music file that resided on the phone.
SHAWN GRAHAM: And what was the name of the song that was played?
MIKE PHIPPS: It is Country Girl, Shake It For Me, by Luke Bryan.
SHAWN GRAHAM: All right. Moving on to 6:42 p.m. on August 28th, what do we see?
MIKE PHIPPS: This falls under the searched items category. In this case it's specific to Youtube, or Youtube app meaning that person was doing the search within the search box on Youtube and they did a key word search for Sasha Xpander original, which, through research, I've learned is a synthesized music piece.
SHAWN GRAHAM: As we move on down to August 28th at 7:00 o'clock p.m., there's a call log entry. What do we see there?
MIKE PHIPPS: Here we see several back-to-back missed calls. These are incoming calls that weren't answered by the phone or by anyone operating the phone. In this case all four missed outgoing -- incoming calls were from Amber Marie McCalley. And you see the duration is zero seconds on all of them.
SHAWN GRAHAM: And were you able to determine who Amber Marie McCalley is?
MIKE PHIPPS: Yes. That's going to be the mother of the children.
SHAWN GRAHAM: So there was a missed call -- incoming missed calls at 7:00 o'clock, 7:02, 7:05 and 7:09 p.m?
MIKE PHIPPS: That's correct.
SHAWN GRAHAM: The next entry at 7:10 p.m., would you tell the jury what that is?
MIKE PHIPPS: This is from the call log, again, but it's an outgoing call to Amber, and that call lasts for one minute and 20 seconds.
SHAWN GRAHAM: At 7:12 p.m., what's that entry?
MIKE PHIPPS: Here, we have an incoming call -- excuse me, from Amber that lasts a minute and 54 seconds.
SHAWN GRAHAM: Moving down to the 7:14 p.m., still on the same evening.
MIKE PHIPPS: Again, we have a string of missed calls at 7:14, 7:16 and 7:17 all belonging to Amber.
SHAWN GRAHAM: At 7:19 p.m., the bottom entry on this page, the first page of this exhibit, what do we see?
MIKE PHIPPS: We see an incoming call at 7:19 from Amber that lasts one minute and two seconds.
SHAWN GRAHAM: Moving on to the second page. Continuing on the night of August 28th, 2014. Now it's 7:56 p.m. What did you find?
MIKE PHIPPS: This is a missed incoming call. Through research, we identified the number as belonging to CVS pharmacy. Specifically one located in Newberry. It has, of course, a zero second duration because it was missed call.
SHAWN GRAHAM: The next artifact that you reported in your report on the evening of August 28th is at 8:30 p.m., correct?
MIKE PHIPPS: That is correct.
SHAWN GRAHAM: And that is coming, from, it says it's another search on Youtube. Is that correct?
MIKE PHIPPS: Yes. It's a search for the key words, American History X Rape Scene.
SHAWN GRAHAM: American History X Rape Scene?
MIKE PHIPPS: That is correct.
SHAWN GRAHAM: Now, are you familiar with the movie American X?
MIKE PHIPPS: Yes.
SHAWN GRAHAM: And is there a rape scene within the movie, American X?
MIKE PHIPPS: Yes. American History X was a movie in the late '90s. The principle character in the movie is sentenced to prison. While he's in prison, he's brutally assaulted in a shower scene and sexually assaulted.
SHAWN GRAHAM: Now, are you able to determine whether whoever was operating the phone actually viewed that rape scene or whether they just searched for it?
MIKE PHIPPS: We can't tell that. All that I'm able to determine is that he entered those search terms within the Youtube app or the web page.
SHAWN GRAHAM: At the time on that search, again, was what?
MIKE PHIPPS: At 8:30 and 32 seconds in the evening on the 28th.
SHAWN GRAHAM: As we continue down passed that, the next entry is at 9:16 p.m. Would you describe to the jury what that entry shows?
MIKE PHIPPS: It's a missed incoming call from Amber followed up at 9:34 by an incoming call that was answered that has a duration of one minute and 12 seconds, and following that up at 9:42 is another incoming call. This one is tagged as rejected. So unlike one that just goes unanswered, someone actually swiped to reject the call saying they didn't want to answer it.
SHAWN GRAHAM: Continuing on down to 9:57.
MIKE PHIPPS: At 9:57, again, another incoming missed call from Amber.
SHAWN GRAHAM: Now, we're moving to August 29th, correct?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: At 7:30 a.m. in the morning, an outgoing call is made from this phone and were you able to determine to what number the outgoing call was made?
MIKE PHIPPS: Yes. The number belonged to the Safe Federal Credit Union and the call lasted for a minute and twenty seconds.
SHAWN GRAHAM: Continuing on to the morning now of the 29th at 7:43 a.m., what do we see?
MIKE PHIPPS: We see another incoming missed call. This time, it belonged -- the number belongs to the Defendant's father, Tim, Sr. Of course, it has no duration because it was missed.
SHAWN GRAHAM: 9:36 a.m. on the 29th.
MIKE PHIPPS: Another missed incoming call. This time, from a person identified in his address book as Christina --
SHAWN GRAHAM: Ehlke?
MIKE PHIPPS: Yeah. I can't pronounce the last name. I'm sorry.
SHAWN GRAHAM: Through your investigation, were you able to determine that she was the children's babysitter?
MIKE PHIPPS: Yes.
SHAWN GRAHAM: So that's a call at 9:36 where it's also been followed up with a text at 9:36. Is that correct?
MIKE PHIPPS: There's a text at 9:38.
SHAWN GRAHAM: 9:38. Thank you.
MIKE PHIPPS: 9:38:49 there's a text message incoming. It's also -- the logs tell us whether the individual ultimately read the message. So --
SHAWN GRAHAM: You denoted by putting in parentheses, read --
MIKE PHIPPS: Correct.
SHAWN GRAHAM: -- is that correct?
MIKE PHIPPS: And, again, from Christina.
SHAWN GRAHAM: Now, the content of that text message and we are talking, the date on this was the 29th. Is that right?
MIKE PHIPPS: Correct. At 9:38 a.m.
SHAWN GRAHAM: The text content that was sent by Christina Ehlke to that phone was what?
MIKE PHIPPS: It reads, "Just wondering if the kids are coming."
SHAWN GRAHAM: And what's the next artifact that you found?
MIKE PHIPPS: At 10:52, an outgoing text message. This time to Christina Ehlke, and the text message read, "Don't worry about this morning. I'll see you later next week."
SHAWN GRAHAM: So there was an outgoing text on that phone to Christina Ehlke that said, "Don't worry about this morning. I'll see you later next week."
MIKE PHIPPS: That's correct.
SHAWN GRAHAM: And that was done on the morning of August 29th?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: Moving down to the next artifact, what do we see?
MIKE PHIPPS: At 10:54 in the morning, an incoming text message, it was read, from Christina and it reads, "So are they coming Monday or when?"
SHAWN GRAHAM: The next response?
MIKE PHIPPS: At 10:55, an outgoing to Christina. It reads, "Tuesday." Followed up at 10:57 by an incoming from Christina that reads, "Okay. Well, you all have a good Labor Day."
SHAWN GRAHAM: All right. Continuing on, then, after those text messages.
MIKE PHIPPS: At 11:02 in the morning there was a Google search this time for a particular phone number, the number of 996-2020, which was determined to belong to Vision Eye Care.
SHAWN GRAHAM: Continuing on, on the 29th at 12:11?
MIKE PHIPPS: Another Google search. This time the key words were Herbal Incense Atlanta and Georgia strung together. At 12:12 --
SHAWN GRAHAM: All right. So the date and time it was a web history or was it a Google search, I am sorry.
MIKE PHIPPS: It was a Google search.
SHAWN GRAHAM: And what time was it?
MIKE PHIPPS: At 12:11.
SHAWN GRAHAM: All right. So when you say a Google search of in this column, you said Herbal Incense, Atlanta, Georgia, and it's a Google search. Is that what the user of that phone actually typed into Google and searched?
MIKE PHIPPS: That is correct.
SHAWN GRAHAM: So that was the phrase that the user of the phone chose and the way they spelled it?
MIKE PHIPPS: Correct.
SHAWN GRAHAM: And what time was that?
MIKE PHIPPS: At 12:11 p.m.
SHAWN GRAHAM: On what day?
MIKE PHIPPS: On the 29th.
SHAWN GRAHAM: And then, continuing on to the next one, what do we see?
MIKE PHIPPS: It's immediately followed up at 12:12 with some web history activity, a website, which is Yellowpages.com and the site -- the title of the site is Herbal Incense Smoke Shops near Atlanta, Georgia, with reviews, YP Mobile, Yellowpages Mobile.
SHAWN GRAHAM: So was that a search or is that web history?
MIKE PHIPPS: That's web history.
SHAWN GRAHAM: So would you explain to the jury, when we go from a search to a web history, what that means?
MIKE PHIPPS: It means -- of course, obviously, when you search something on Google, there's a table of results and when you click on something, it's going to, potentially, take you to that website. So it's showing the initial Google search and the fact that someone clicked on something after that, which took them to this Yellowpages.com website.
SHAWN GRAHAM: And the next entry is at what time?
MIKE PHIPPS: At 12:14 p.m. and it's from the call logs showing an outgoing call. The number that was listed there was ultimately identified as a number belonging to the Zam Zam Incense Shop located at 109 Peachtree Street, Atlanta, Georgia. The call lasted for 13 seconds.
SHAWN GRAHAM: So we're now down on the 29th at 12:14 in the afternoon, an outgoing call to a number, which you verified that belonged to a business called Zam Zam Incense Shop located in Atlanta, Georgia?
MIKE PHIPPS: That's correct.
SHAWN GRAHAM: The final entry on this page.
MIKE PHIPPS: It's at 1:17 in the afternoon. It's a Google search for the key words, Herbal Incense Illegal in Alabama.
SHAWN GRAHAM: Were you able to determine whether spice was legal or illegal in the State of Georgia in September of 2014?
MIKE PHIPPS: Yes, I was.
SHAWN GRAHAM: And what did you determine?
MIKE PHIPPS: It was criminalized in Alabama in 2011.
SHAWN GRAHAM: How about in Georgia and Mississippi?
MIKE PHIPPS: Mississippi, I did not research. In Georgia, it was criminalized in 2010.
SHAWN GRAHAM: Moving on to the third page, Investigator. We're still on August 29th. The top entry is at what time?
MIKE PHIPPS: At 1:19 in the afternoon.
SHAWN GRAHAM: And it's a web history?
MIKE PHIPPS: Correct. It's showing activity on a website, WCTV.TV website. The page title is, "Georgia issues alert over herbal incense."
SHAWN GRAHAM: Moving down to the next search item at 1:51.
MIKE PHIPPS: It's a Google search. The key words entered here is Herbal Incense Alabama.
SHAWN GRAHAM: The next web history at 1:51, what is that?
MIKE PHIPPS: It's a web address Adpost.com and the paper title is, "Supernova herbal incense and others available for sale from Alabama."
SHAWN GRAHAM: The next web history at 1:52, on the 29th?
MIKE PHIPPS: Again, from a website, The Head Shop Finder. The page reads, "Alabama head shops and smoke shops. Bongs, kratom, glass pipes, pipe shops, vaporizers in Alabama."
SHAWN GRAHAM: The next web search at 1:52, what is that?
MIKE PHIPPS: Again, the same website, The Head Shop Finder, for a Zero Gravity Smoke Shop in Decatur, Alabama.
SHAWN GRAHAM: Moving on to the call logs at 1:52 p.m. on the 29th, what do we see there?
MIKE PHIPPS: We see an outgoing call to a number that was identified as belonging to the Zero Gravity Smoke Shop with a zero duration.
SHAWN GRAHAM: Where was the Zero Gravity Smoke Shop located?
MIKE PHIPPS: In Decatur, Alabama.
SHAWN GRAHAM: Moving on to the next at 2:17 p.m. the call log entry, what do we see?
MIKE PHIPPS: It's a missed -- an incoming call that was missed from Roberta Thornsberry followed up by two more incoming calls from the same number, Roberta Thornsberry. One showing a duration of six seconds, and the other two seconds. And then at 2:22, another incoming call that was ultimately rejected followed up by five more calls through 2:38 p.m. that were all rejected, incoming from Roberta.
SHAWN GRAHAM: As we continue on down to the bottom of the page after those rejected calls, what do we find?
MIKE PHIPPS: Web activity on The Head Shop Finder. This time it's a page with the title, "Illusion Smoke Shop in Birmingham, Alabama." And then --
SHAWN GRAHAM: The next entry?
MIKE PHIPPS: Immediately followed by a page from the same website that reads, "Cloud Nine Southside Tattoo and Piercing Smoke Shop in Birmingham, Alabama."
SHAWN GRAHAM: And then the two last calls on the third page.
MIKE PHIPPS: The first one is a missed incoming call from Roberta at 4:13, and then at 4:30 p.m., an outgoing call to Roberta that lasts 31 seconds.
SHAWN GRAHAM: Moving on to the next page.
MIKE PHIPPS: On the 29th at 4:41 p.m., there was a Google search for the key words, herbal incense Mississippi illegal, followed by some web history at the same time. The website was Blog. -- .com with the title, "Mississippi law makers snuff out spice." That's followed up by another Google search at 4:44 for the key word, C-A-M-P-U-N-G. After that, it goes directly into some web history. The website is ReserveAmerica.com for campgrounds and camping reservations. And that rolls into two missed incoming calls at 5:00 and 5:02 p.m. on the 29th from Roberta.
SHAWN GRAHAM: Roberta Thornsberry, we've seen a lot of calls from her. Were you able to determine whether that was his grandmother or not through your investigation?
MIKE PHIPPS: I was not.
SHAWN GRAHAM: As we continue on, there was two missed incoming calls there on the 29th at 5:00 o'clock. As we continue on now, we see a text message. Is that correct?
MIKE PHIPPS: Yes. At 5:04 p.m., there's an incoming text message that's read from Roberta. The content was, "Tim, I want you to come in. I mean, I'm not sick, contagious to the kids. So I just -- I need to see the babies. I need to see you come in."
SHAWN GRAHAM: And that was from Roberta Thornsberry?
MIKE PHIPPS: Yes.
SHAWN GRAHAM: As we continue on down the afternoon/evening of the 29th after that text, what do we see?
MIKE PHIPPS: On the 29th at 5:04 p.m., there's a missed incoming phone call from the Defendant's father. That's followed up at 5:09 of two missed incoming calls at 5:09 and 5:22 from Roberta. From there, there's an incoming read text message at 5:24 p.m. It reads, "Hello. Where are you," and that's from Roberta, followed up by an incoming missed call from Roberta at 5:24 p.m. Then, again, at 5:25 p.m., an incoming read text message from Roberta that reads, "Are you getting my messages? Come on. I know you can text, or are you in a meeting?" That's followed up at 5:28 p.m., another missed incoming call from Roberta. And then we have two rejected incoming calls at 6:00 and 6:12 p.m. from Roberta. At that point on the 29th at 6:34, there's an incoming -- actually, there's two incoming rejected calls back-to-back from a number that was identified as coming from Market Traders Institute.
SHAWN GRAHAM: Were you able to determine what Market Traders Institute is?
MIKE PHIPPS: It's a website that facilitates traders and they offer a platform for actual trading, educational tools, research tools to facilitate trading in stocks.
SHAWN GRAHAM: You're saying a rejected call. That's different from a missed call how?
MIKE PHIPPS: It's different as in the user, whoever had possession of the phone, chose to swipe it to silence it and reject it.
SHAWN GRAHAM: Moving on to the next page. We're now -- we're still on August 29th at 6:40 p.m.
MIKE PHIPPS: At 6:40, there's an outgoing text message to Roberta that reads, "Sorry. Been tied up today." That's followed up by another outgoing at 6:41, again to Roberta, that reads, "Not going to be able to make it today." That's followed up by an incoming text from Roberta at 6:48 p.m. that reads, "Call me, please. What's going on, sweetheart? Call me."
SHAWN GRAHAM: Continue on down.
MIKE PHIPPS: Then we have two incoming phone calls at 7:02 and 7:03, both of them from Roberta, and they're rejected calls. At 7:06, there's an incoming read text message from Roberta that reads, "Hey, sweetheart. When you get a chance, give me a call. I love you and your phone seems to be messed up. Maybe you should get an iPhone." That's followed up at 7:27 with another read incoming from Roberta that reads, "You need to let me know if you're coming in this week. I've got all this meat. What do I do with it?" That leads into at 7:28 p.m. a rejected call from the Defendant's father. At 8:04 p.m. there's an outgoing call to the Market Traders Institute. It only lasts one second. Following up on that at 9:10 p.m., in the call log there's a rejected call from Roberta. That leads into 9:39, a text message incoming from Roberta that reads, "Where are you?" Another at 9:40 from Roberta that reads, "Love you all. Got lots of clothes for the kids." Another incoming at 10:01 from Roberta that reads, "Do you want to meet up on Sunday, Tim?" At -- that was on the 29th at 10:01 p.m. The next is the next day at 8:30 -- on 8/30, rather, at 9:39 a.m. It's an incoming read text message from Roberta that reads, "Where are you? What are you doing?" Another at 11:57 a.m. from Roberta that reads, "Call me right now." And then another at 11:58 from Roberta that reads, "Why aren't you taking my calls, question mark. By the way, Odell, a lot better." At 11:58 a.m., another incoming text message from Roberta that reads, "When do you want to meet up with me? I have all these clothes and things for the children." At 5:13 p.m., another incoming from Roberta that reads, "Why are you not taking my calls, question mark. By the way, Odell, a lot better."
SHAWN GRAHAM: Now, are you picking and choosing what we're showing here or is this everything? Are these all the text messages during the time period?
MIKE PHIPPS: These are all the text messages during that time period.
SHAWN GRAHAM: Same with the web searches and web history?
MIKE PHIPPS: Correct.
SHAWN GRAHAM: Same with the Google searches?
MIKE PHIPPS: Correct.
SHAWN GRAHAM: And the same with the call logs showing incoming and outgoing and missed and rejected calls?
MIKE PHIPPS: That is correct.
SHAWN GRAHAM: Moving onto the next page.
MIKE PHIPPS: The next page starts on August 31st of 2014. Incoming read test message from Roberta that reads, "When do you want to meet up with me? I have all these clothes and things for the children." At 5:13:06, incoming from Roberta. "Where are you? What are you doing?" At 5:13, an incoming from Roberta that reads, "Call me right now." From there, at 7:58 p.m. on September 1st is a Youtube search for Bob Carlisle, Butterfly Kisses. On the 1st at 10:00 a.m., the call log reflects an outgoing call to Christina Ehlke that has no duration. At 10:08 a.m., there's a Google search for camping, South Carolina. That leads into some web activity from 10:08 through 10:10 a.m. from the South Carolina Parks.com website and several sections of that site were accessed. The first being the tent and RV camping in South Carolina state parks, campground cooking in South Carolina state parks, boating and camping at state parks and trailside camping in South Carolina state parks.
SHAWN GRAHAM: Moving on to 10:13 on the 1st.
MIKE PHIPPS: On the 1st at 10:13 there's a Google search with the key words of South Carolina dumps. That rolls into some web activity at the same time on the LexCo South Carolina.gov website.
SHAWN GRAHAM: And that's the government website for Lexington County, correct?
MIKE PHIPPS: That's correct. For Lexington County. The areas of that website that were accessed were the collection and recycling centers, the index, landfill, items accepted, the home page and animal services.
SHAWN GRAHAM: Moving on, after that there were some Youtube search items. Is that correct?
MIKE PHIPPS: Correct. At 11:24 a.m. there's a Youtube search for Styx, Long Arm of the Law. Immediately followed up at 11:31 was another Youtube search for Styx, Long Arm of the Law, lyrics.
SHAWN GRAHAM: Moving on to the next page.
MIKE PHIPPS: At 11:31 on the 1st, another Youtube search for Comfortably Numb, Pink Floyd lyrics. At 4:54 p.m., there's an incoming text message from Christina. This one we have a notation that it was read late.
SHAWN GRAHAM: What does that mean?
MIKE PHIPPS: So in this instance, you can see that the text message came in, but we can also see a time stamp of when the text message was actually -- or the app that contains the text message was opened to look at it. So in this instance, we noted that it came in at 4:54 p.m. on the 1st, but it wasn't read or accessed until 6:14 p.m.
SHAWN GRAHAM: And that was from which individual?
MIKE PHIPPS: Christina.
SHAWN GRAHAM: The children's babysitter?
MIKE PHIPPS: That is correct.
SHAWN GRAHAM: And what were the contents of that?
MIKE PHIPPS: It reads --
SHAWN GRAHAM: What were the contents of that text?
MIKE PHIPPS: It reads, "Just a reminder, please bring some diapers tomorrow."
SHAWN GRAHAM: Moving on to the next text, what do we see?
MIKE PHIPPS: It's 6:19 p.m. There's an outgoing text to Christina with -- it reads, "Busy," with a question mark. And then at 6:19:36, there's an incoming from Christina that reads, "Okay." At 6:19:55, there's an outgoing call to Christina that lasts 17 minutes and 34 seconds, and that's followed up at 7:00 p.m. with an incoming phone call from Amber that lasts seven seconds. That rolls into September 2nd at 10:35 in the morning with a Youtube search. The stream that was entered in the Youtube search was dog search for body in landfill, followed up at 9:38 a.m. with another Youtube search of cleaning pool with muriatic acid. At 10:41 a Youtube search for muriatic acid burn, followed by 10:43, a Google search for camping Columbia, South Carolina. The result of that Google search at 10:44 shows web activity. The website was River Bottom Farms.com. The title page was, "Yogi Bears Park camp resort in Columbia, South Carolina." And then there's web activity at 10:44, Goodsand camping at Columbia, South Carolina, campgrounds. At 10:46, there's a Google search. The key words that were entered were, what does no extradition laws mean.
SHAWN GRAHAM: What does no extradition laws mean?
MIKE PHIPPS: Correct. At 10:57, there was web history. The website was, findlaw.com. The title page was, "Five countries with no U.S. extradition treaty, findlaw." I know what that reads from my reference--
SHAWN GRAHAM: What does it say?
MIKE PHIPPS: It says there was web history at 10:58 in the NPR.org website and the title page read, "If you face a U.S. legal problem, where should you run."
SHAWN GRAHAM: Facing legal problems, where should you run?
MIKE PHIPPS: Correct.
SHAWN GRAHAM: Continue on.
MIKE PHIPPS: At 10:59 a.m., there was an incoming text message that was read from Christina Ehlke, and it reads, "Can you send me a text saying I have permission to enter the house and clean and keep what I want just so I don't get in trouble." At 11:03 a.m. on the 2nd, there was an outgoing call -- I'm sorry, outgoing text message to Christina that reads, "Sure. Go ahead and clean up." And then there's another outgoing at 11:04 to Christina, again, that reads, "Everything is okay," question mark.
SHAWN GRAHAM: Continuing on -- we're still on September 2nd, I believe. Is that correct?
MIKE PHIPPS: Yes.
SHAWN GRAHAM: Google search--
MIKE PHIPPS: -- at 11:04 a.m. on the 2nd, a Google search for camping, Route 77, exit 88, South Carolina. That's followed up at the same time. A few seconds later, there's an incoming test message that was ultimately read from Christina Ehlke that just reads, "K." The letter K. At 11:07, another incoming read message from Christina that reads, "I haven't done anything, bc or because I want to make sure you don't want any of your stuff," or S-T-U-F-E. At 11:10 a.m., there's an incoming read text message from Christina that reads, "I would call -- I will call His House Charity to pick up the stuff I didn't want." At that point at 11:10, there's an outgoing text to Christina that reads, "Okay." At 11:10 a.m., there's an incoming from Christina that reads, "Is that okay, THT." At 11:11, there's outgoing text to Christina that reads, "Yeah. They're yours." Then at 11:11 an outgoing -- or incoming read from Christina saying, "Thank you and take care." An outgoing at 11:12 to Christina that reads, "You, too. Same to you." At 11:46, an incoming text message that was ultimately read late. It was actually read at 1:19 p.m. on the 2nd and it's an incoming from Jim McConnell.
SHAWN GRAHAM: Were you able to determine who Jim McConnell was?
MIKE PHIPPS: It was the Defendant's supervisor.
SHAWN GRAHAM: At Intel?
MIKE PHIPPS: Intel.
SHAWN GRAHAM: And what was the substance of that text?
MIKE PHIPPS: It reads, "Hey. Are you coming into work today?" question mark. "Did I miss an email," with another question mark. At 12:58 on the 2nd, there's web history indicating activity on the KOA.com website for Charlotte, Fort Mill KOA campgrounds in South Carolina. Then there was an outgoing call at 1:21 in the afternoon on the 2nd to a number that we identified as belonging to Fidelity Investments that lasted 43 seconds. At 1:38 p.m. on the 2nd there was a missed incoming call from a number that we identified as belonging to Saxe Gotha Elementary School, and that's immediately followed up by a second missed call from the same number, Saxe Gotha. At 1:53 p.m., there was an incoming text message from Jim McConnell that reads, "There," question mark. At 5:55 p.m. on the 2nd, incoming missed call, also belonging to Saxe Gotha Elementary School. At 5:59 p.m., a missed call from Amber with a zero second duration. At 6:04, another incoming call from Amber. This time with a duration of four minutes and 35 seconds. And then at 10:06 p.m., there's an outgoing call to Christina Ehlke that lasts 12 seconds.
SHAWN GRAHAM: On what date and time was this?
MIKE PHIPPS: September 2nd of 2014 at 10:06 in the evening.
SHAWN GRAHAM: And there's a few more pages to go. The first entry on the next to last page.
MIKE PHIPPS: Then at 10:06, the call log indicates an incoming call from Christina that lasts 56 seconds. At 10:08 p.m., an incoming call from Christina that lasts 14 minutes and 45 seconds. At 11:52 p.m. there was a database that registered a location for the phone. The app that reported that was AccuWeather.com. It was a widget weather app where you -- it reports your local weather for your date and time. This indicated that at that date and time it was reporting a location showing the latitude and longitude. That resolves back to an area around the City of Gray, Georgia. At 8:10 a.m. on the 3rd, there was an incoming text message from Jim McConnell. "Hey. I've been trying to get in touch with you. Please give me a call when you get this." At 10:07 a.m., the call logs indicate an incoming missed call from Kevin McKinney. Actually -- and then that's followed up by an incoming rejected call just a minute later from Kevin McKinney as well. At 10:10, there was an incoming text message.
It was read late. It was read actually the next day. It comes in on the 3rd, it's read on the 4th at 3:39 a.m. It reads, "Hey, Tim. Call me ASAP." On the 3rd at 12:11 p.m., there's another incoming text message, read late, from Jim McConnell. It was read on the 4th at 3:39 a.m. "Hey. Are you there," question mark. At 9:03 -- on 9/3 at 1:16 p.m., an incoming text message that went through a spam folder from a Terry Jackson. It reads, "Are you through with the roach spray and the bottle. Drop by store." At 4:41 p.m., an incoming read late text message that was read on the 4th at 9:27. It reads, "Hey. Call me when you can," from Travis Jones. At 4:42, again another text from Travis Jones that was read late and it reads, "It's an emergency." At 5:15 p.m., an incoming text message from Roberta and it reads, "Timmy, please, baby, let Grandma know where you're at. Please. Please. Call me, please." At 5:16 p.m., an incoming text message from Roberta that reads, "I can do your, sweetheart.
So scared. Please, call me -- call me." At 5:25 p.m., an incoming text message from a Brian Day. That reads, "Are you around? No OOP message. Might want to touch base with JC JIM if you haven't." At 5:33 p.m., an incoming text message from Roberta that reads, "Tim, call me, please. I'm begging you. Please, call me." At 6:51 p.m., an incoming text from Apollo Jones that reads, "Timmy, man, what's going on with you," question mark, exclamation. "Come on, bro. Why are you doing this." At 7:02 p.m., an incoming text from Jim McConnell. "Please, give me a call."
SHAWN GRAHAM: On the last page.
MIKE PHIPPS: September 3rd at 9:00 p.m., an incoming text message from Martha Weis, (phonetic). It reads, "Hey, Tim. Haven't heard from you lately," question mark, "How is everything going," question mark, "Do the kids start school yet," question mark, "I love you, honey. We're very proud of you. Please call. I haven't talked with you in a while. We need to catch up. I love you mucho, mucho. Kiss all the babies for me."
SHAWN GRAHAM: Continue on.
MIKE PHIPPS: At 9:32 p.m., an incoming text from Aunt Rosa Linda. It reads, "Hi, sweetie. Is everything going all right? Aunt Rosa Linda." At 3:37 in the morning, there was a powering event.
SHAWN GRAHAM: What does that mean?
MIKE PHIPPS: It just means that the phone had been off for a period of time and we can detect that the power's back up at this point. That was significant because of the read late messages. The times that those messages were read were around that powering event. So the device had been off, it comes back on, all those notifications of those text messages would have appeared at that point.
SHAWN GRAHAM: On what day was the powering event?
MIKE PHIPPS: We're on the 4th at 3:37 in the morning.
SHAWN GRAHAM: Continue on.
MIKE PHIPPS: At 3:41 a.m., there's an outgoing call. That number was identified as the voice messaging service for that phone. That was identified in the SIM card on the phone and it's showing a seven second duration call immediately followed up at 3:43 in the morning, the same number, 33 seconds.
SHAWN GRAHAM: And then after that, there was some web history?
MIKE PHIPPS: Correct. At 3:44, there's web history at the Nomad Capitalist.com website. The title page that it landed on was, "The best non-extradition countries to be invisible." And then, I guess, there's a notation that's not available, possibly meaning that he hit a dead link. He was trying to go to that link and there wasn't anything there.
SHAWN GRAHAM: There's a Google search next. What is the date and time of that Google search?
MIKE PHIPPS: At 3:47 in the morning, there was a Google search with the key words, missing children Tim Jones.
SHAWN GRAHAM: And then the last one.
MIKE PHIPPS: At 8:34 a.m. on the 4th, there's an incoming text from Roberta that reads, "Tim, if your phone is working, please call Grandma. I'm going out of my mind. I love you." That's followed up at 9:30 with an incoming text that reads, "Mr. Jones, this is Beth Houck, principal at Saxe Gotha. I am checking to make sure the students are okay. I've noted they have been absent since Thursday. At 12:58 p.m., there's an incoming text that reads, "Your family is looking for you, but if you need to lay low or get out of Dodge, you call me, bro. I got you. Love you, brother." At 12:58 p.m., there's another incoming text that reads, "Tim, what's up, dog. It's Rudy, your FA, are you okay. I don't know what's going on, but you need anything, money, a place to stay, anything, let me know, bro."
SHAWN GRAHAM: So as far as the last activity you saw on this phone as far as user activity, what is the date and time of the last user activity you saw?
MIKE PHIPPS: It would be this incoming read text message at 12:58 p.m. There was some additional indications that the phone was accessed as far as being powered on through the evening of the 5th, but there wasn't anything that we could identify as user actions as far as call logs, text messages, photos taken. That kind of thing.
SHAWN GRAHAM: And that was at 9:27 p.m. on what day?
MIKE PHIPPS: On September 4th. You're talking about the last time that we --
SHAWN GRAHAM: -- you detected user activity.
MIKE PHIPPS: September 5th and I'll have to look at the exact time, but it was late in the evening.
SHAWN GRAHAM: Thank you, Investigator Phipps. You can have a seat in the witness stand. (Whereupon, the witness returns to the witness stand.)
SHAWN GRAHAM: Mr. Phipps, are you aware of whether the battery was in the phone or not in the phone that was found by Stacy Jones with the Mississippi Bureau of Investigation on the search warrant back in Mississippi?
MIKE PHIPPS: The investigative note said that it was not in the phone.
SHAWN GRAHAM: Thank you, Investigator Phipps. Please, answer any questions the Defense has.
THE COURT: We need a break. So step in the jury room and we'll go back out here. Don't discuss the case. (Whereupon, the jury was excused from open court for a break.)
(Whereupon, a short break was taken.)
THE COURT: All right. So you're ready, Mr. Young, if I send the jury?
BOYD YOUNG: Yes, sir. I had some phone numbers in here--
SHAWN GRAHAM: One of the things Mr. Young and I discussed was on the State's 77 which is in evidence, Agent Phipps was looking at, there was one entry that was crushed. I got a clean copy, you can actually read what the web history for that one is.
THE COURT: Everybody okay with substituting the easier to read version?
BOYD YOUNG: Yes, sir.
THE COURT: Substitute one for the other.
SHAWN GRAHAM: Put a new number on that one and it is in evidence. (Whereupon, State's Exhibit 77 was admitted into evidence.)
THE COURT: Bring the jury in. (Whereupon, the jury came into open court at approximately 4:50 p.m.)
THE COURT: All right. Mr. Young, your witness.
CROSS-EXAMINATION By Mr. Young:
BOYD YOUNG: Agent Phipps, you have in front of you a copy of an extraction report, right?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: And that's a copy of the one that I'm using right now, right?
MIKE PHIPPS: It is.
BOYD YOUNG: And that extraction report was generated by the Solicitor's Office. They went through and they picked out what records they wanted to reflect and report, and then printed those out?
MIKE PHIPPS: That is correct.
BOYD YOUNG: And these are not all the records that are on the phone, right?
MIKE PHIPPS: That's correct.
BOYD YOUNG: All of the records on the phone, I think you told me, was somewhere around 24,750 --
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: -- total data points, is that what we're calling them?
MIKE PHIPPS: Yes.
BOYD YOUNG: Artifacts --
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: -- is that right? And this report -- and I'm not going to go through the whole thing, but this report includes about 1,240 of them in total, right?
MIKE PHIPPS: It does.
BOYD YOUNG: Okay. All right. I just want to go through -- and this includes -- in the beginning page of this extraction, it includes text messages, phone calls and web searches. Is that right?
MIKE PHIPPS: It does.
BOYD YOUNG: Anything else?
MIKE PHIPPS: I haven't looked through the entirety of it to see if there are any other categories included.
BOYD YOUNG: Okay.
MIKE PHIPPS: It appears to be just text, web history, searched items and notes. Instant messaging is included. I believe that's all.
BOYD YOUNG: All right. I'm going to start with page three down at the bottom. These last three messages. Do you see where it says, "From Candace"? Do you know who Candace is?
MIKE PHIPPS: I do not.
BOYD YOUNG: Okay. If I told you she was one of the babysitters for the Jones children -- I'm telling you. She's one of the babysitters for --
MIKE PHIPPS: Okay.
BOYD YOUNG: -- the Jones children. Okay? She says, "What do you want Merah to write", right?
MIKE PHIPPS: That is correct.
BOYD YOUNG: And there's a response to Candace that's from Tim, right?
MIKE PHIPPS: It's an outgoing text to Candace from Tim that reads, "I will use my hands to make good and not trouble."
BOYD YOUNG: If we go -- sorry. The date on that message was May the 20th, 2014. Is that right?
MIKE PHIPPS: That is correct.
BOYD YOUNG: And then on May the 21st, 2014 were there more messages from Candace about what did Merah have to write?
MIKE PHIPPS: Yes, there was.
BOYD YOUNG: I'm sorry. I should -- and then I'm skipping down to line 39. It says, "In her mouth, shall be found the law of kindness," right?
MIKE PHIPPS: That's correct.
BOYD YOUNG: That's what Tim says that she had to write?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: Now, on 5/25/14, do you see where at 5:20:22 p.m. Tim used a search, right? Search items for Beautiful Mind Trailer?
MIKE PHIPPS: That is correct.
BOYD YOUNG: And then schizophrenia patient?
MIKE PHIPPS: That is correct.
BOYD YOUNG: And then schizophrenia patient talking?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: And then schizophrenia person seeing people?
MIKE PHIPPS: That is correct.
BOYD YOUNG: And then he sends Amber McCalley a message, right? "Something's bothering me about Merah. She's saying some creepy stuff."
MIKE PHIPPS: Correct.
BOYD YOUNG: And that's at 5:57 p.m., right?
MIKE PHIPPS: That is correct.
BOYD YOUNG: And then he says, "Call me late tonight. Something you really need to hear," and that's at 7:00 p.m. to Amber, right?
MIKE PHIPPS: Yes.
BOYD YOUNG: I'm skipping forward to page 15 at 6:28. Do you see line 277? There's an outgoing text message.
MIKE PHIPPS: I do.
BOYD YOUNG: And it's to Amber?
MIKE PHIPPS: It is.
BOYD YOUNG: And it says, "This is supposed to be our 10th anniversary. I still love you. I'm crying. Anyhow, good night."
MIKE PHIPPS: Yes.
BOYD YOUNG: And then on the 20 -- and then later that night, on the same night at 11:30 p.m., Tim starts Googling or searching stuff on the internet?
MIKE PHIPPS: Correct.
BOYD YOUNG: And he's searching, how can young women get caught, because of older women?
MIKE PHIPPS: Yes.
BOYD YOUNG: Warning signs that my ex-wife is being prostituted?
MIKE PHIPPS: Yes.
BOYD YOUNG: Eleven signs your woman is fixing to whore from a site called Christwire?
MIKE PHIPPS: Yes.
BOYD YOUNG: And then he starts searching on Backpage, which Backpage is a site that prostitutes used to use to advertise for services. Is that right?
MIKE PHIPPS: It was prevalent with escort services. Yes.
BOYD YOUNG: Okay. And he starts searching for a phone number in there, right?
MIKE PHIPPS: He does.
BOYD YOUNG: And I've blacked it out on here, but you have it up, right?
MIKE PHIPPS: Yes, I do.
BOYD YOUNG: And he's using a number that was Amber's number, it's one digit off the first couple times he does it, and then he starts using the correct number and continues doing it, right?
MIKE PHIPPS: Yes, he does.
BOYD YOUNG: I'm skipping to page 16 on the 29th at 8:33. He's still looking for Amber Jones on Backpage. Is that right?
MIKE PHIPPS: Yes.
BOYD YOUNG: I'm skipping to page 21. I believe the date is 7/10/2014. I'm starting at message 432. Are you with me?
MIKE PHIPPS: On which page?
BOYD YOUNG: Page 21.
MIKE PHIPPS: Which line?
BOYD YOUNG: 432.
MIKE PHIPPS: All right.
BOYD YOUNG: There's a message from Amber, right?
MIKE PHIPPS: Yes. Incoming from Amber.
BOYD YOUNG: And this is at 7:42 p.m., right?
MIKE PHIPPS: It is.
BOYD YOUNG: On July the 10th?
MIKE PHIPPS: Yes.
BOYD YOUNG: "And if they don't want to see me, that's fine, but I'm not going to buy them things to only disrespect me as their mother in the end." Right?
MIKE PHIPPS: Correct.
BOYD YOUNG: And then, she sent him another message. "Don't ask for your Korean stuff or anything else because I don't owe you anything, Tim Jones. You've taken everything from me. So you need not ask me for another damn thing."
MIKE PHIPPS: Correct.
BOYD YOUNG: And then Tim responds at 7:44 p.m., right?
MIKE PHIPPS: Yes.
BOYD YOUNG: He says, "They want you to listen to them as they've been recommended by their therapist to express themselves to their mother and you won't let them speak. Anyway, have a nice night." Right?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: And then, he sends the XOXO?
MIKE PHIPPS: He does.
BOYD YOUNG: And then he says, "You can keep the Korean stuff if you want. Peace out. Bye."
MIKE PHIPPS: Yes.
BOYD YOUNG: And then she responds at 7:46 p.m, is that right?
MIKE PHIPPS: Yes, she does.
BOYD YOUNG: And she says, "Kiss my ass with that XOXO shit. I'm not the one who has done -- I'm not the only one who has done wrong and you know it. I've answered their questions. I'm not reliving it every day. It's not happening." Right?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: And then, she responds, "I'll throw it away.".
MIKE PHIPPS: She does.
BOYD YOUNG: And then he responds to her at 7:48 p.m. "Well, sorry to burst your bubble, pumpkin, but they want to ask you about what happened. They want closure." Right?
MIKE PHIPPS: Yes.
BOYD YOUNG: And then Amber response to that, "I gave it to them and teached, (phonetic), them how to pray. God's the only one that can heal their hearts."
MIKE PHIPPS: Correct.
BOYD YOUNG: And then, finally, Tim says, "You didn't give it to them or they would not be seeking it from you." Right?
MIKE PHIPPS: Yes.
BOYD YOUNG: Looking at the bottom of page 22, the last three lines, 480, 481 and 482. These are two incoming messages from Amber, right?
MIKE PHIPPS: They are.
BOYD YOUNG: And these are Youtube URL links?
MIKE PHIPPS: Yes.
BOYD YOUNG: And you and I have talked about this, but you don't know what those go to, right?
MIKE PHIPPS: I do not.
BOYD YOUNG: Like if they go to a song or a movie or a movie clip, but you could just click on them and it would take you to whatever's there, right?
MIKE PHIPPS: Yes. Whatever's there now, yes.
BOYD YOUNG: Okay. If I told you that it was a John Legend song, All Of Me, you wouldn't have any reason to doubt that?
MIKE PHIPPS: I do not.
BOYD YOUNG: And if I told you the second one was The Dance by Garth Brooks, you wouldn't have any reason to doubt that?
MIKE PHIPPS: No, sir.
BOYD YOUNG: Okay. And then Tim says, "It looks like a job for a good plastic surgeon, your job security XD," right?
MIKE PHIPPS: Yes.
BOYD YOUNG: I'm skipping to page 23. On July the 20th, 2014, Tim does a Google search for betrayed by my young children, right?
MIKE PHIPPS: He does.
BOYD YOUNG: And there's several searches around there that are all, basically, for the same thing, right?
MIKE PHIPPS: Yes.
BOYD YOUNG: And then on 7 -- July 23rd at 7:51 p.m., Amber sends another couple of Youtube URLs, right?
MIKE PHIPPS: She does.
BOYD YOUNG: And then she sends a message after that says, "That song is all I've been wanting to say to you, but you're so caught up in what I've done wrong that you don't want to hear it. You did wrong to me as well, but I don't need to sit and bring it and rub it in your face all the damn time because it gets old as hell." Right?
MIKE PHIPPS: Yes.
BOYD YOUNG: I'm skipping ahead to page 35 and this is August the 9th of 2014 around line 743. Do you see that?
MIKE PHIPPS: I do.
BOYD YOUNG: And this is a text message from Amber to Tim, right?
MIKE PHIPPS: It is.
BOYD YOUNG: And it says, "Thought it would be neat for the kids to see," and we don't know if she got -- sent a picture with it or what that came from, right?
MIKE PHIPPS: That's correct.
BOYD YOUNG: But we do know that Tim said to Amber, "Hey. You got any of those college textbooks I had in the large blue tub in the shed where all my father's tools were stolen? I could use some of those for the children to do science and physics experiments." Right?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: And then, he sends one more message. "By the way, I will show the children your grandmother's picture in the morning." Right?
MIKE PHIPPS: Uh-huh (Affirmative response).
BOYD YOUNG: I'm skipping ahead to page 37. On August the 16th of 2014 at 9:40 p.m., Tim is searching -- this is a Google search for child killed by an electrical outlet?
MIKE PHIPPS: On page 37?
BOYD YOUNG: Page 37, numbers --
MIKE PHIPPS: Okay. Yeah.
BOYD YOUNG: -- 686.
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: And that's just a Google search or just put it in a search engine?
MIKE PHIPPS: From this timeline, I can't determine that. There's more data in another part to determine whether it's a Google search or a Youtube search. I believe I may have a note on that, but let me refer to my notes.
BOYD YOUNG: Okay.
SHAWN GRAHAM: Mr. Young, what page are you on?
BOYD YOUNG: Thirty-seven.
MIKE PHIPPS: My notes indicate that was a Youtube search.
BOYD YOUNG: Okay. I'm moving ahead to page 39 on 8/17/2014 at 8:03 p.m., line 791. Are you with me?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: And the question is, "Can I use, HAS funds for Nicorette," and then, under it is, "Can I use HSA funds for Nicorette." A Google search, right?
MIKE PHIPPS: Yes.
BOYD YOUNG: And you know what HSA funds are?
MIKE PHIPPS: Not exactly. No, sir.
BOYD YOUNG: Health Savings Account funds?
MIKE PHIPPS: I've never -- I've heard of it, but I've never had an account. So I'm --
BOYD YOUNG: Okay. Do you know --
MIKE PHIPPS: -- not familiar.
BOYD YOUNG: Do you know what Nicorette is?
MIKE PHIPPS: I know what Nicorette is. Yes.
BOYD YOUNG: Nicorette's a stop smoking chewing gum?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: I'm going to August the 18th of 2014 at 9:58 a.m. There's a message online, 8:15, from Christina Ehlke. Do you see that?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: And it says, was Gabe--
MIKE PHIPPS: -- yes.
BOYD YOUNG: All right. And Christina Ehlke's already testified she told the jury that -- on the 18th, that's when the kids started school and Gabe walked out of the house, right? Is that -- were you here for that testimony?
MIKE PHIPPS: No. I have not.
BOYD YOUNG: Okay. Just a couple more, Agent Phipps. I'm going to page 44. This is on August the 26th at 12:54 p.m. Do you see that? Number 921.
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: Is this -- this is a purchase from Kindle, right?
MIKE PHIPPS: 12:54 p.m. Yes. It's an entry from the Kindle store.
BOYD YOUNG: Brush me, floss me, be my friend. Welcome to Toothville, learning begins here. A kid's book about caring for their teeth from the Kindle store, right?
MIKE PHIPPS: It's a web history for the Kindle store. I can't tell you whether the item was purchased or not, but, yes.
BOYD YOUNG: Do you know whether or not a Kindle was recovered in the items that were recovered from Mr. Jones' car?
MIKE PHIPPS: I do not.
BOYD YOUNG: All right. If I told you that there was a Kindle recovered from Mr. Jones' car, would you have any reason to doubt that?
MIKE PHIPPS: No, I don't.
BOYD YOUNG: On page 45 on August the 26th of 2014 on lines 948 and, again, at 950, there was search items, right?
MIKE PHIPPS: There are.
BOYD YOUNG: And the question being searched is, "Is Intel planning further layoffs in 2015"?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: Last two. Skip ahead to page 58 and there are two notes on this page. Do you see those, do you have those in front of you?
MIKE PHIPPS: Yes, I see them.
BOYD YOUNG: Okay. And the first note on that page, which was created on August the 17th of 2014 at 9:00 -- it's at 9:22 a.m. and that's a school supply list, right?
MIKE PHIPPS: It is.
BOYD YOUNG: And it goes through what you sort of would expect to have to put a number of children into school, right?
MIKE PHIPPS: Yes, sir.
BOYD YOUNG: And then, at the bottom of the page, created on August the 4th of 2014 at 9:54:50 a.m. is what appears to be a weekly meal list, right?
MIKE PHIPPS: It does.
BOYD YOUNG: And then, a way to add those to the grocery list. Is that right?
MIKE PHIPPS: Yes.
BOYD YOUNG: And it's got breakfast, lunch and dinner for each day?
MIKE PHIPPS: It does. Yes.
BOYD YOUNG: Thank you, Agent Phipps. That's all the questions I have.
SHAWN GRAHAM: Your Honor, the State would offer this into evidence.
THE COURT: Any objection to--
BOYD YOUNG: -- yes, sir.
THE COURT: Okay. Do we need to get it on the record or--
SHAWN GRAHAM: -- I'm sorry, Your Honor.
THE COURT: We need to get it on the record or not. We're on the record, but without the jury.
SHAWN GRAHAM: I can finish my questioning, but I do want to offer it into evidence.
THE COURT: Okay. Finish your questions quickly.
REDIRECT EXAMINATION By Mr. Graham:
SHAWN GRAHAM: Agent Phipps, going back to page four. You were asked, I believe, about searches on May 25th of 2014 at 5:24, 5:28, 5:32 and 5:34 p.m., is that correct?
MIKE PHIPPS: Yes.
SHAWN GRAHAM: What were those searches, again?
BOYD YOUNG: Asked and answered.
THE COURT: I'll let him answer it. I really don't think we need to go through the whole thing again.
MIKE PHIPPS: Give me just a minute to reference where they came from. Those were all Youtube searches, specifically, and the content deals with A Beautiful Mind and schizophrenia.
SHAWN GRAHAM: All right. Actually, above that, the searched item was for A Beautiful Mind Trailer, right?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: And are you familiar with the movie, A Beautiful Mind?
MIKE PHIPPS: I've heard of it. I've not seen the movie.
SHAWN GRAHAM: Are you aware that it's about a schizophrenic?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: So after there's a search for the Beautiful Mind Trailer, then there's searches on Youtube for video of schizophrenia patient, schizophrenia patient talking, schizophrenia person seeing people, schizophrenia person A Beautiful Mind?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: And the last Google -- or the last Youtube search was at 5:34 on May 25th, right?
MIKE PHIPPS: Yes, sir.
SHAWN GRAHAM: The next entries in here are outgoing texts to Amber. Isn't that correct?
MIKE PHIPPS: They are.
SHAWN GRAHAM: And that is the same afternoon, approximately, 23 minutes --
BOYD YOUNG: Objection. Leading.
THE COURT: He's leading. Sustained.
SHAWN GRAHAM: Item 52, do you see that?
MIKE PHIPPS: It is. It's an outgoing text message at 5:37 p.m.
SHAWN GRAHAM: And it's from -- it's to who?
MIKE PHIPPS: To Amber.
SHAWN GRAHAM: And the content of the text message is what?
MIKE PHIPPS: It reads, "Something is bothering me about Merah. She was saying something -- she's saying some creepy stuff."
SHAWN GRAHAM: "Something is bothering me about Merah --
MIKE PHIPPS: Merah.
SHAWN GRAHAM: -- she's saying some creepy stuff." That's what was texted out to Amber?
MIKE PHIPPS: It was.
BOYD YOUNG: All of this has been asked and answered.
THE COURT: We're going to finish it tomorrow. I promised the jury I'd take care of them and I am. So we're done for the day. Don't talk about the case. See you in the morning early. Don't talk about the case. So see you in the morning. (Whereupon, the jury was excused from open court for the day.)
THE COURT: I told the jury I would take care of it. I'm sorry, but today was kind of herky-jerky on them. I didn't mean to be that way, but I want to take care of them if I absolutely can. So, we can finish Agent Phipps in the morning, we'll just have to do that. All right? So I apologize, but I wanted them taken care of because we've had enough trouble with delays and waiting. We'll start back in the morning. All right. See you in the morning. You can't talk to anybody about your testimony.
MIKE PHIPPS: Yes, sir. (Whereupon, the witness stepped down from the witness stand).
SHAWN GRAHAM: Your Honor, can I get that marked, I guess, at this moment, for ID and offer it into evidence.
COURT REPORTER: Which one?
SHAWN GRAHAM: The copy the Defense was questioning him out of the extraction that Mr. Young used. That's what I offered into evidence and he objected to it. So it, at least, needs to be marked for ID.
THE COURT: Yeah. It'll be marked for ID right now. (Whereupon, State's Exhibit number 199 was marked for identification only.) (Whereupon, the trial will resume the next day at 9:00 a.m.)