📱The Silent Witness: The Phone Speaks Volumes While John Can not

📞The Phone Stayed Put

Using Apple’s Health app data and motion sensors, Wiffen showed that the three recorded “flights of stairs” and 80 steps occurred while the phone was in a moving car between 12:21am and 12:24am before they arrived at 34 Fairview. Two of the elevations were on Dedham St., and the other on Cedarcrest at the time of the 3-point turn after missing their turn onto Fairview—not during any alleged basement beatdown.

⚠️Warning: Sarcasm Incoming:

Let’s play along with the defense and say the CW timeline is off—John and Karen arrived at 12:21 a.m., and John went inside. Oh, sure. John walked into the house, and was immediately whisked down three mysterious flights of stairs? Or… he went down one flight, got beaten, sprinted back up for cardio, then politely got dragged back down—all while a party of twelve watched a “It’s Raining Men” video without seeing or hearing a thing. Makes perfect sense.

🗺️An Expert Opinion: The iPhone Location

Wiffen also analyzed the location data extracted from John O’Keefe’s iPhone. Despite the stormy weather and ongoing debate about who placed the phone where and when, Wiffen’s analysis found the device didn’t stray far from the flagpole at 34 Fairview from 12:32 AM, when John locked his iphone for the last time, until 6:00 AM, when John’s body was found.

The following diagram, presented in court by Whiffen, shows location points identified throughout the night that had 10 meter range accuracy. This means 10M accuracy does not get John into the house. These data points were recorded throughout the night. Unless John was going in and out of the house all night long, it is impossible that he went into the house, according to this data.

❄️ Cold Case: Battery Temperature Tells a Chilling Tale

Credit where credit is due: this compelling new piece of evidence was unearthed by forensic expert Ian Whiffen, whose sharp analysis brought the iPhone’s battery temperature into the spotlight—something that was completely absent from the first trial. Whiffen deserves serious respect for digging into the data and flushing out this valuable information.

In a fascinating side experiment, Wiffen tested iPhone battery temperature changes by placing test phones outside and in a freezer. Although this test didn’t replicate the behavior of John’s phone, it did prove that the battery will lose temperature when placed in a cold environment. Based on John’s phone dropping from 82°F to 61°F between 12:13 and 12:53 AM, then down to 37°F by 6:14 am, Wiffen concluded that the phone was exposed to cold outdoor conditions—supporting the idea it had been left near the flagpole alongside John O’Keefe where he was found.

The Cross

Crossfire: Prosecutor Alessi Goes on the Attack

Defense attorney Robert Alessi focused his cross-examination of digital forensic analyst Ian Whiffen on the timeline of John O’Keefe’s phone data, questioning the accuracy, completeness, and forensic standards used in Whiffen’s analysis.

Alessi appeared intent on painting Wiffen as selective in his data presentation—suggesting possible bias in favor of the defense. Confirmation bias claims seem to be his modus operandi in most of his crosses.

🔍 Timeline & Device Data Confusion

Alessi poked at the cell phone data. The arrival  time, as presented by the prosecution is 12:24:38. The defense suggests the arrival time was when the flights of stairs and 80 steps took place at 12:21:10.

There was a FaceID phone unlock logged at 12:24:59 and Alessi asked if someone else could unlock the phone using their face. Whiffen replied that it would have to be set up in his phone. [This doesn’t seem likely.] When asked if he checked if anyone else was registered in his phone to unlock his phone via their face, Whiffen responded that he hadn’t checked.

[I can’t imagine who in that house would have been allowed to have access to John’s phone]

Alessi also pointed out that a “read” text message wasn’t labeled as being from Brian Higgins. [It was pretty clear who it was from, per three lines up the phone activity spreadsheet says who the message was from.]

Alessi also jumped on the cell phone motion data — user walking vs. in a car. The speed was 1.4 mph, but no steps were logged, so the implication that John was walking at that time is just speculative.

🥶 Phone Temperature: The Chill Heard Round the Courtroom

Discussion then turned to the phone’s battery temperature. Alessi pressed Whiffen on why he included battery temperature analysis in his report and whether it was relevant to the investigation. Whiffen affirmed that he considered the data very important, which is why he included it. [This data is actually crucial in demonstrating that at least John’s phone never entered 34 Fairview.]

Alessi referred to a test described in Whiffen’s report. An iPhone X running the same iOS as O’Keefe’s iPhone 11 was placed in a freezer at 73.4°F. After 15 minutes, the phone’s temperature dropped to 50°F, a drop of 23.4°F. A second test, conducted outdoors in 35°F conditions, showed the phone’s temperature decreasing from 71.6°F to 35.6°F, a drop of 36°F in 13 minutes.

Alessi questioned whether these tests were applicable and pointed out that O’Keefe’s phone lost temperature at a much slower rate. Whiffen explained that in his testing, the phone was subjected to ambient air temperature.

Alessi’s obvious point was to challenge the accuracy of the data from John’s phone, John was found lying on top of his phone, therefore, the battery would reduce temperature at a slower rate. It is questionable whether this topic helped the defense more than the Commonwealth. Alessi may have been better off skipping this point.

📱 Hash Values & Forensic Tools

Alessi tried to shake confidence in Cellebrite and hash value validation. [Does the jury even know what “hash values” are? I didn’t recall a foundation on that, but maybe I zoned out among all the tech talk, which is likely what the jury did.]

But Whiffen stayed calm:

All the hashes were unsigned, which is normal in some contexts.

No anomalies or signs of tampering were found.

The hash mismatch ≠ data corruption.

When Alessi raised the “Cellebrite removed the timestamp” drama regarding Jen McCabe’s Google search, Whiffen tried to explain it wasn’t nefarious — the software originally misstated a timestamp (2:27:40 AM). That’s why it was corrected. Whiffen’s research in this case prompted the change in the Cellebrite software. The Cellebrite forensic research group verified the change. Cellebrite actually fixed a bug where the data was displayed incorrectly, but they did not delete the data point.

A competitor of Cellebrite called Magnet Axiom also worked on this case. Their report still shows the 2:27 am search, and they are expected to be called during the defense case in chief. Whiffen states that Magnet refers to the time of the search differently.

Side note: Alessi tends to cut witnesses off before they complete their answer. When the judge asked Alessi to wait untl the witness finishes, he said he “couldn’t hear” and thought he was finished. [Not buying that.]

🕵️‍♂️ Attempts to Impeach Credibility

Alessi tried to trap Whiffen into contradictions: why wasn’t some info mentioned yesterday? Did you talk to Guarino? Can you tell if someone was walking or riding in a car? But none of these really landed. The Jen McCabe repeated call times to John were brought up again (12:29 AM), but there was no dramatic new takeaway.

👨‍🔬The Redirect

During redirect, Whiffen emphasized the independence and scientific basis of his work, confirming that no party in the case attempted to influence his findings.

He detailed experiments he conducted on iPhone battery temperatures, showing that batteries cool in cold environments and warm when brought back to heat—consistent with the data from John O’Keefe’s phone on the night in question.

Whiffen testified that O’Keefe’s phone moved briefly at 12:31 a.m. for 20 seconds (36 steps recorded), then remained still until 6:15 a.m. He could not determine the direction or exact nature of the movement.

Location data, though somewhat broad, was consistent with the phone remaining near the flagpole from approximately 12:30 a.m. until 6:15 a.m., supported by health data, temperature logs, and facial detection information.

Whiffen also analyzed call logs involving Jennifer McCabe and Karen Read, noting that McCabe’s early calls did not place O’Keefe’s phone at Fairview and that Read made seven calls by the time the phone’s battery temperature began dropping.

Addressing data integrity, Whiffen confirmed the hash values of the phone extractions matched, with no sign of tampering.

He discussed the Safari search for “hos long to die in the cold,” which had a timestamp of 2:27 a.m., but Whiffen reiterated that it was a suspended tab artifact and the actual input occurred at 6:23–6:24 a.m.—a position backed by his independent tool, industry research, and subsequent changes made to the Cellebrite software to prevent future confusion.

He concluded that, based on multiple layers of data, the phone’s behavior and location were consistent with it remaining near the flagpole throughout the night.

Ultimately, Wiffen’s expert opinion was unequivocal: John O’Keefe’s phone remained in the area of the flagpole from the time of arrival (around 12:24 AM) until after dawn. The phone’s lack of meaningful movement and other sensor data supports the theory that John never entered 34 Fairview.

Jennifer McCabe’s Google search occurred at 6:24 am, not 2:27 am.

And finally, the mysterious three flights of stairs and steps logged on John’s phone at 12:21 am took place while he was still in the car around the time just before and just after the 3-point turn on Cedarcrest. It is unknown why the phone logged the elevations.

Related Articles

Related