Inspired by the great
@sk716 I went down the rabbit hole about whether there could have been multiple logins to SMs cloud services **
To recap, at the prelim, Grusing testified that according to Law Enforcements evidence, SM was alive and well on Friday night, arranged to meet up with Barry, drove in her RR to near his location, spoke with him on the phone for 73 seconds, and subsequently met with him at Tailwinds site. We don't have full insight into this, as the CAST and Telematics were not exhibited in full. We just have to trust Grusing that the as to what the investigation found out. The investigation originally believed this was last proof of life for SM - which is why they tore the site up.
So is it actually possible for BM to have spoofed messages on SMs social media from secret device?
(** the following analysis applies particularly to Apple, Google, Whatsapp, LinkedIn etc)
- Looking just at Apple ID, for access to iMessage etc it is perfectly possible to have multiple devices logged in to the same ID. I currently have 3! However these show up as different device instances under my account info. In other words, apple is logging what devices are connected to your ID. You can see how this would look here Check your Apple ID device list to find where you've signed in
- When i connect the second device, i get an alert on the primary device - and there is also 2FA set up. So you need the original devices to add another device often.
- So in theory, I can add a second device, send iMessages from the same account, but not from the iPhone in question. The recipients don't know which device the message is sent from....
- Then later, I still need to delete the second device from the iCloud devices ... BUT
- This is only covering my tracks in the front end - i.e the consumer interface
- In the apple logs for this account, there is still the record of this device being added and removed. Indeed it seems BM did this on his own account, and the record of an unknown device is still lurking there in the logs.
You can repeat the gist of this analysis on any of the main cloud services SM was using. At the end of the day, Law Enforcement will see in the access logs, SM iPhone machine ID logging into the services. If there was a secondary device also logged in, monitoring her activity - this would show up in the logs.
Even if her iPhone then logged off on Friday and a different device was really sending the messages, it would be apparent to Apple, LinkedIn, etc that it was not her iPhone doing it.
This is why LE is confident of the last proof of life. BM could not be in two places at once - and the spoofing theory only works at a superficial level, so long as they never subpoena Apple and Linkedin.
There are a lot more problems with the spoofing theory, like SMs phone activity over the cellular network which is unique to her SIM but I think the above is more obvious.
tldr; when apple found a second device logged in to SMs icloud, but then deleted on Saturday, the whole scam would have been revealed
IMO the conclusion is the opposite one. Following SMs murder, the killer
did not have access to her iPhone or iCloud. Otherwise the killer could have sent proof of life messages to randos on saturday evening - surely the most obvious thing to do. Especially had BM known of SMs LinkedIn exchange with JL, he could have sent an obvious 'raincheck - see you tomorrow" type of message. The problem was even if he suspected, he didn't find it.
02c