Thanks..I guess I missed that there was an extraction of the podcaster's phone that was referenced in the tweet.
TX - Moriah Wilson, 25, Cyclist Fatally Shot Before Race, Austin, 2022 *arrest* #8
- Thread starter BrownRice
- Start date
- Status
Regretfully, I missed this post.
Prosecution: were two of the items actual geolocation data for Moriah Wilson’s phone and Colin Strickland’s phone?Portnoy: Yes.
11:21 AM · Nov 13, 2023
Strickland appears to have responded to the message with, ‘thank you!’ We’ve previously heard that Wilson’s last messages were to a podcaster.
10:31 AM · Nov 13, 2023
Prosecution: were two of the items actual geolocation data for Moriah Wilson’s phone and Colin Strickland’s phone?Portnoy: Yes.
11:21 AM · Nov 13, 2023
Strickland appears to have responded to the message with, ‘thank you!’ We’ve previously heard that Wilson’s last messages were to a podcaster.
10:31 AM · Nov 13, 2023
@JessicaTaylorTX
Defense is going over all of the devices Portnoy attempted to extract data from. Portnoy says he spent months trying to get into the iPhone 11 Pro, saying he didn’t have brute force entry.
12:22 PM · Nov 13, 2023
Jessica hasn't tweeted for 25 mins. Above is last tweet. Stay tuned as tweets will pick up.
Defense is going over all of the devices Portnoy attempted to extract data from. Portnoy says he spent months trying to get into the iPhone 11 Pro, saying he didn’t have brute force entry.
12:22 PM · Nov 13, 2023
Jessica hasn't tweeted for 25 mins. Above is last tweet. Stay tuned as tweets will pick up.
It appears there was a 15 min recess. Carissa tweeted - about the break.
@CarissaonFOX7
Back from quick break. Defense asks if phone powering off (Armstrong's phone was powered off for a period on May 11) means it was manually turned off. DP says he cannot prove that - could have been battery dying
@fox7austin
12:50 PM · Nov 13, 2023
@CarissaonFOX7
Back from quick break. Defense asks if phone powering off (Armstrong's phone was powered off for a period on May 11) means it was manually turned off. DP says he cannot prove that - could have been battery dying
@fox7austin
12:50 PM · Nov 13, 2023
jash
Well-Known Member
- Joined
- Nov 9, 2011
- Messages
- 3,491
- Reaction score
- 21,483
Carissa Lehmkuhl
@CarissaonFOX7
Defense: Points out DP said it was 'very much possible' Wilson photos were in cache because Armstrong was looking at Instagram DP: “I’m always careful in explicitly saying anything is 100% when I look through the data."
11:58 AM · Nov 13, 2023
Defense points out that merely scrolling through Instagram could create a cached image - DP agrees
@fox7austin
12:16 PM · Nov 13, 2023
Back from quick break. Defense asks if phone powering off (Armstrong's phone was powered off for a period on May 11) means it was manually turned off. DP says he cannot prove that - could have been battery dying
@fox7austin
12:50 PM · Nov 13, 2023
@CarissaonFOX7
Defense: Points out DP said it was 'very much possible' Wilson photos were in cache because Armstrong was looking at Instagram DP: “I’m always careful in explicitly saying anything is 100% when I look through the data."
11:58 AM · Nov 13, 2023
Defense points out that merely scrolling through Instagram could create a cached image - DP agrees
@fox7austin
12:16 PM · Nov 13, 2023
Back from quick break. Defense asks if phone powering off (Armstrong's phone was powered off for a period on May 11) means it was manually turned off. DP says he cannot prove that - could have been battery dying
@fox7austin
12:50 PM · Nov 13, 2023
Mid-morning thread on Day 7 of #KaitlinArmstrong trial
12:52 PM · Nov 13, 2023
Defense is asking about tracking location. Portnoy discussing Find my IPhone. He says that you can log in from another device using iTunes email and potentially find your missing device.
12:53 PM · Nov 13, 2023
12:52 PM · Nov 13, 2023
Defense is asking about tracking location. Portnoy discussing Find my IPhone. He says that you can log in from another device using iTunes email and potentially find your missing device.
12:53 PM · Nov 13, 2023
@JessicaTaylorTX
Defense says, on the iPhone 11, did Portnoy find any location sharing apps. Portnoy says he did not look through the contents. When asked why, he says because the extraction was already prepared.
12:55 PM · Nov 13, 2023
Defense says, on the iPhone 11, did Portnoy find any location sharing apps. Portnoy says he did not look through the contents. When asked why, he says because the extraction was already prepared.
12:55 PM · Nov 13, 2023
What a coincidence…her battery dies (LOL) at the same time there is video of her Jeep, then mysteriously get charged and back on when her Jeep heads out after the murder…
Please defense…this is ridiculous
RickshawFan
Verified Outdoor Recreation Specialist
- Joined
- Jun 9, 2013
- Messages
- 11,289
- Reaction score
- 57,001
I thought they were looking at KA's phones?
Asking about the tracking points and vehicle movement. State previously had Portnoy describe the route Armstrong’s Jeep took prior to Wilson’s death. Defense asks if Portnoy is an expert of GPS. Portnoy says he is not.
12:58 PM · Nov 13, 2023
@JessicaTaylorTX
Portnoy says for the purposes of the movement and the data, he had enough to provide his impression. Defense says, “when it comes to how it works, error rates, you’re not expert right?” Portnoy tries to dispute this assessment, and defense circles back to expert status.
1:00 PM · Nov 13, 2023
Portnoy says that Garmin would have more knowledge than himself when it comes to the error messaging.
12:58 PM · Nov 13, 2023
@JessicaTaylorTX
Portnoy says for the purposes of the movement and the data, he had enough to provide his impression. Defense says, “when it comes to how it works, error rates, you’re not expert right?” Portnoy tries to dispute this assessment, and defense circles back to expert status.
1:00 PM · Nov 13, 2023
Portnoy says that Garmin would have more knowledge than himself when it comes to the error messaging.
- Joined
- Feb 25, 2013
- Messages
- 45,155
- Reaction score
- 463,368
Brianna Hollis
@BriHollisNEWS
Back at the courthouse this morning for #KaitlinArmstrong's murder trial. Testimony ended last week w/ an APD digital forensic detective addressing GPS data showing Armstrong's Jeep near the home where prosecutors say she killed Mo Wilson in May 2022. Follow live updates here.
6:18 AM · Nov 13, 2023
Testimony begins. The State has called back digital forensics detective Daniel Portnoy.
7:12 AM · Nov 13, 2023
His testimony begins with an iPhone submitted to evidence that Portnoy extracted data from. Taking a look at the phone's IMEI (essentially a phone fingerprint) and sim card. He confirms it's Wilson's.
7:21 AM · Nov 13, 2023
Portnoy goes through activity history on Wilson's phone from 8:37 p.m. to 9:13 p.m. on May 11, the day Wilson died. Says phone was generally in use that entire time.
7:26 AM · Nov 13, 2023
Portnoy says when he extracts data was phones, he has access to the location data, so he can tell where people are during specific uses.
7:34 AM · Nov 13, 2023
Portnoy: There "appeared to be relevant data" to Wilson's death on her laptop. Now moving on to another phone listed as belonging to Armstrong.
7:41 AM · Nov 13, 2023
Portnoy explains data extraction report showing that phone turning off at 7:30 p.m. and back on at 9:47 p.m. on May 11.
7:45 AM · Nov 13, 2023
Portnoy now reviewing a phone he says belonged to Colin Strickland.
7:47 AM · Nov 13, 2023
That call log shows Armstrong calling Strickland at 4:24 on May 11, they spoke for about three minutes. Armstrong called again at 6:24, log shows Strickland did not pick up.
7:51 AM · Nov 13, 2023
Portnoy addresses a phone that was factory reset.
8:07 AM · Nov 13, 2023
Portnoy discusses a sim card - linked to a California phone number - was identified as belonging to a K. Armstrong.
8:11 AM · Nov 13, 2023
Now reviewing location data extracted from Wilson's phone. Data points show latitude/longitude points. Portnoy verifies the accuracy of that.
8:27 AM · Nov 13, 2023
We've been getting into the weeds with digital forensic stuff again - that's why my posts are a little more scattered. Current phone data we're looking at show what Portnoy says is someone viewing Wilson's Instagram on May 2 as well as a screenshot of plane ticket for Armstrong
8:42 AM · Nov 13, 2023
Viewing more images from what Portnoy says is Armstrong's phone. One is of Armstrong at gun range in January 2022, a month after Strickland says he bought two guns. Portnoy says photo was sent to or from Armstrong's phone.
8:43 AM · Nov 13, 2023
State displays text from Armstrong to a Kyle Sanders in Nov. 2021, while she and Strickland for broken up. Text says she was in Mexico on Strickland's birthday and suggests Strickland was in atx with Wilson at the time.
8:48 AM · Nov 13, 2023
Defense now has Portnoy.
8:53 AM · Nov 13, 2023
Defense begins by establish with Portnoy that, when it comes to images, Portnoy doesn't necessarily have all of the nuanced information connected to said photos.
8:56 AM · Nov 13, 2023
Defense asks Portnoy on how department organizes cases when it comes to digital forensic needs. Portnoy says a discretion call is made by supervisors between forensics unit and homicide unit. "Semi-formal protocol."
9:06 AM · Nov 13, 2023
Defense asks Portnoy about cached images, and they establish that could indicate images user scrolled past OR downloaded.
9:14 AM · Nov 13, 2023
Defense asks Portnoy about location data on May 11 from Wilson's and Strickland's phones. Portnoy says a memory chip has location data. Other ways to track location - cell towers and Wi-Fi connection.
9:18 AM · Nov 13, 2023
Defense appears to be trying to poke holes in the reliability of said location data. In the data Portnoy presented, we saw lat/long lines and a meter-measured perimeter of where the phone would be. We say 35 and 50 meters in some of those examples.
9:19 AM · Nov 13, 2023
Portnoy says it was ‘unlike other extractions’ because had to follow guidance from Berla. Defense clarifies you don’t take apart phones, tablets, etc. Portnoy says not that he’s aware of. Appears they’re discussing the Uconnect.
1:03 PM · Nov 13, 2023
@JessicaTaylorTX
Defense asks an unsuccessful attempt Portnoy and team performed on the Uconnect was not mentioned during state’s examination. Portnoy says he can’t speak to that.
1:04 PM · Nov 13, 2023
1:03 PM · Nov 13, 2023
@JessicaTaylorTX
Defense asks an unsuccessful attempt Portnoy and team performed on the Uconnect was not mentioned during state’s examination. Portnoy says he can’t speak to that.
1:04 PM · Nov 13, 2023
- Joined
- Feb 25, 2013
- Messages
- 45,155
- Reaction score
- 463,368
Brianna Hollis
@BriHollisNEWS
As Defense continues cross of Portnoy, Armstrong speaks briefly with one of her attorneys. Her mother and father are here, sitting in the second row. Wilson's family and friends once again take up the first three rows on the prosecutors' side.
9:47 AM · Nov 13, 2023
Defense is addressing the data that shows Armstrong's phone being off from roughly 7:30-9:45 p.m. the night Wilson died.
9:48 AM · Nov 13, 2023
Defense now asks Portnoy about the GPS tracking displayed Thursday that showed Armstrong's car driving from south Austin to the east Austin neighborhood where police say Armstrong killed Wilson.
9:57 AM · Nov 13, 2023
On that interactive map, it sometimes showed the vehicle not moving in a straight line, so Defense is asking about that.
9:59 AM · Nov 13, 2023
Portnoy says the map doesn't always generate straight lines because it's created through "track points" which might create a line through, i.e., a building vs. rounding a corner.
9:59 AM · Nov 13, 2023
@BriHollisNEWS
As Defense continues cross of Portnoy, Armstrong speaks briefly with one of her attorneys. Her mother and father are here, sitting in the second row. Wilson's family and friends once again take up the first three rows on the prosecutors' side.
9:47 AM · Nov 13, 2023
Defense is addressing the data that shows Armstrong's phone being off from roughly 7:30-9:45 p.m. the night Wilson died.
9:48 AM · Nov 13, 2023
Defense now asks Portnoy about the GPS tracking displayed Thursday that showed Armstrong's car driving from south Austin to the east Austin neighborhood where police say Armstrong killed Wilson.
9:57 AM · Nov 13, 2023
On that interactive map, it sometimes showed the vehicle not moving in a straight line, so Defense is asking about that.
9:59 AM · Nov 13, 2023
Portnoy says the map doesn't always generate straight lines because it's created through "track points" which might create a line through, i.e., a building vs. rounding a corner.
9:59 AM · Nov 13, 2023
-- Morning testimony - 11.13.2023
Back in court for the continuation of #KaitlinArmstrong ‘s trial.
Detective Daniel Portnoy is back on the witness stand. The state continues by asking Portnoy about the devices he worked to extract data from. A photo is displayed of an iPhone and charging code. Portnoy points out numbers from the IMEI and the SIM card.
Prosecution pulls up a ‘GrayKey Progress Report’ from an iPhone 13 mini. Portnoy reads off the account owner associated - Moriah Wilson. Portnoy confirms they extracted over 123 GB from Wilson’s phone.
Prosecution pulls up a Cellebrite Extraction Report. One of the headings reads ‘Applications Usage Log.’ Portnoy says that contains a lot of info - but it shows what apps are being used. Portnoy says it shows use of text messages, instagram, and switching btw apps.
Portnoy says that that the data shows app usage on Wilson’s phone from May 11, 8:46 p.m. Google drive application was used on 9:13 p.m., acc to Portnoy. Text message app usage at May 11, 9:13 p.m. Portnoy says the phone was generally in continuous use, in the document timeframe
State pulls up a new exhibit, a Cellebrite extraction report showing text message. This is btw Wilson and Christopher Strickland (no relation to Colin.) Texts from 9:13 read:‘A vertical and a horizontal’ - Strickland‘Just dropped some in. Lemme know if these will work’ - Mo
Strickland appears to have responded to the message with, ‘thank you!’ We’ve previously heard that Wilson’s last messages were to a podcaster.
Portnoy says there are multiple ways for a phone to collect (location) data. Wi-Fi, towers, metadata from images, more.
Prosecution asks Portnoy about a MacBook computer, which he says belonged to Moriah Wilson. We’re seeing photos of a blue cloth compute case, and the MacBook computer.
Portnoy says he didn’t find anything that completely stood out, pertaining to Wilson’s death, but the data was stored in case.
A new state exhibit. An iPhone (on airplane mode) and phone case.
Portnoy now referencing the GrayKey Report. He says the device is an iPhone 13 Pro, but the device name is iPhone 11 Pro. Last week, Portnoy described how the iPhone device name can be changed by users, and transfer over at times. Portnoy reads the account owner as ‘Kaitlin.’
Looks to be about 17 GB of data were extracted from this phone - Portnoy described it as ‘limited.’
Court description: many familiar faces from the last two weeks are back in the courtroom - media, observing attorneys. Jurors appear to be looking at the exhibits displayed on the monitors. I can’t see Armstrong’s face, but she’s facing forward, potentially looking at a monitor.
Another state exhibit. Portnoy identifies it as a phone belonging to Colin Strickland. GrayKey report for this phone being displayed. Over 219 GB extracted from this phone.
Portnoy is going over the call log from Strickland’s phone. Prosecution asks Portnoy if the records show that there was an active call, beginning at 9:07 p.m. on May 11, 2022. Portnoy confirms.
Now seeing a report showing contacts that were saved in Strickland’s phone. Interaction status shows if a number or contact was blocked. We see one row with a ‘blocked’ status, and the associated email appearing to belong to Wilson. Portnoy says ‘Christine Wall’ is not blocked.
Now seeing an entire spreadsheet of blocked contacts from Strickland’s phone. This shows 98 contacts. We previously heard a figure in the 70s during Strickland’s time on the witness stand.
Now seeing photos of a computer Portnoy says belonged to Armstrong. Portnoy touches back on the encryption, which interfered with their ability to extract data.
More phones and photos being shown. Last week, Det. Spitler said he requested 25-30 search warrants in this case, partially for cellphones and technology.
Portnoy says only one phone had multiple SIM cards. An iPhone SE.
Portnoy says one thing was “not normal.” The numbers on one of the SIM cards did not match another element on the phone. However, there is a phone number associated. Portnoy says he found the phone number belonged to a ‘K. Armstrong.’
Portnoy talking about SIM card extraction. He says text messages aren’t actually saved to the SIM card anymore. No stored contacts on a SIM card either.
A Lenovo ThinkPad computer was also examined. Portnoy says it was encrypted and they could not extract data. Portnoy says it belonged to Wilson.
Prosecution: were two of the items actual geolocation data for Moriah Wilson’s phone and Colin Strickland’s phone? Portnoy: Yes.
Geolocation data extracted from Wilson’s phone is 440 pages, Portnoy confirms. Document begins May 11, 2022 12:01:09 A.M. and ends May 11, 2022 11:58:29 P.M. Portnoy confirms over 2,000 data points were collected for that timeframe.
Portnoy does not do phone location analysis in his job. Longitude and latitude are captured.
Portnoy confirms the geolocation data captured from Strickland’s phone was 460+ pages.
Portnoy is describing the screenshots on display, a text message from United Airlines about flight check in. Dated May 10th, indicates flight to Austin. Appears this was captured from Wilson’s data. A similar email being shown. A flight reservation for traveler Anna Moriah Wilson
Looking at data files on the iPhone 11. Dated May 2, 2022. Contains an image of a person on a bike. Portnoy says material saved in cache isnt purposefully saved by the user. Portnoy says very much possible the iPhone 11 was looking at image displayed in the thumbnail on instagram
We’re seeing more data with photo thumbnails, which Portnoy confirms were seen from Instagram and saved in the cache. One, though, is a screenshot. Appears to be itinerary for flight, showing traveler Armstrong going to PHX on May 2, 2022.
One of the photos saved in the cache, shows a photograph of Moriah Wilson.
Portnoy says the owner of the iPhone, whose cache we were just viewing, was Kaitlin Armstrong.
Another data report from Armstrong’s iPhone. Portnoy says image from January 13, 2022 was sent or received from Armstrong’s phone via text. Portnoy describes the photos as individuals at a shooting range.
State pulls up text messages btw Armstrong and ‘Kyle Sanders.’ Nov. 7, 2021. Message from Armstrong reads: “Well today is his birthday. He’s at home with a 24 year old who may or may not have moved to Austin. And I’m in Tulum solo. Mostly practicing sound healing,” more.
Another file - April 8, 2022. Portnoy says looking at file path, this is associated with iCloud. Another file from March 9, 2022. File path indicates image was saved to phone somehow. We didn’t see the photo.
State passes the witness. Defense begins their questioning.
-- Defense -- cross examination --
Jeremy Sylestine, with the defense, says he doesn’t want to confuse Portnoy, but there’s some information that’s, “all over the place.”
Portnoy says he’s careful about saying these explicitly. “Lots of times, even when I’m almost 100% certain, I say most likely.”
Defense asks if data is different than witness testimony.“In a way, it can be more factual,” Portnoy responded.Defense says that Portnoy doesn’t want to be speculative, which he agrees with.
Defense asking about nuance, and whether that’s for Portnoy to suppose. Portnoy says he has limited knowledge outside the data.
Defense references back to presentation about Portnoy’s training and scope of work. That was one of the first things discussed by the state. Defense asks if technology has advanced in terms of what’s available to examiners and consumers. Portnoy agrees.
Defense has Portnoy go over some technical details, like how much memory a computer or phone has, how a terabyte is defined.
Portnoy says it could take years to go through the memory of one device, without exterior help like Cellebrite.
Defense asks if Portnoy is generally very busy. He agrees. Defense: Does DFU have a system in place to allow others in the chain of command to give cases a higher priority?Portnoy: Absolutely.
DFU = digital forensic unit
Portnoy says he has almost 100 cases in his queue at any given moment. He says for a very straightforward case, it could take half a day to look at one device.
Defense asks Portnoy to compare iPads and iPhones. Portnoy says they’re relatively similar, using the same iOS and just as challenging to examine.
Defense asks Portnoy if accounts can be open on two devices, like instagram on a phone and iPad. Portnoy says yes. Defense asks if it’s seamless. Portnoy says he hasn’t tried but it doesn't appear difficult.
Defense wants to ask about iPhones and their location data. Portnoy confirms two from Strickland and Wilson which he created reports for, from May 11, 2022.
Portnoy says how many GPS points are included matters, because it depends on totality.
Defense is going over all of the devices Portnoy attempted to extract data from. Portnoy says he spent months trying to get into the iPhone 11 Pro, saying he didn’t have brute force entry.
15 minute recess
Back in court for the continuation of #KaitlinArmstrong ‘s trial.
Detective Daniel Portnoy is back on the witness stand. The state continues by asking Portnoy about the devices he worked to extract data from. A photo is displayed of an iPhone and charging code. Portnoy points out numbers from the IMEI and the SIM card.
Prosecution pulls up a ‘GrayKey Progress Report’ from an iPhone 13 mini. Portnoy reads off the account owner associated - Moriah Wilson. Portnoy confirms they extracted over 123 GB from Wilson’s phone.
Prosecution pulls up a Cellebrite Extraction Report. One of the headings reads ‘Applications Usage Log.’ Portnoy says that contains a lot of info - but it shows what apps are being used. Portnoy says it shows use of text messages, instagram, and switching btw apps.
Portnoy says that that the data shows app usage on Wilson’s phone from May 11, 8:46 p.m. Google drive application was used on 9:13 p.m., acc to Portnoy. Text message app usage at May 11, 9:13 p.m. Portnoy says the phone was generally in continuous use, in the document timeframe
State pulls up a new exhibit, a Cellebrite extraction report showing text message. This is btw Wilson and Christopher Strickland (no relation to Colin.) Texts from 9:13 read:‘A vertical and a horizontal’ - Strickland‘Just dropped some in. Lemme know if these will work’ - Mo
Strickland appears to have responded to the message with, ‘thank you!’ We’ve previously heard that Wilson’s last messages were to a podcaster.
Portnoy says there are multiple ways for a phone to collect (location) data. Wi-Fi, towers, metadata from images, more.
Prosecution asks Portnoy about a MacBook computer, which he says belonged to Moriah Wilson. We’re seeing photos of a blue cloth compute case, and the MacBook computer.
Portnoy says he didn’t find anything that completely stood out, pertaining to Wilson’s death, but the data was stored in case.
A new state exhibit. An iPhone (on airplane mode) and phone case.
Portnoy now referencing the GrayKey Report. He says the device is an iPhone 13 Pro, but the device name is iPhone 11 Pro. Last week, Portnoy described how the iPhone device name can be changed by users, and transfer over at times. Portnoy reads the account owner as ‘Kaitlin.’
Looks to be about 17 GB of data were extracted from this phone - Portnoy described it as ‘limited.’
Court description: many familiar faces from the last two weeks are back in the courtroom - media, observing attorneys. Jurors appear to be looking at the exhibits displayed on the monitors. I can’t see Armstrong’s face, but she’s facing forward, potentially looking at a monitor.
Another state exhibit. Portnoy identifies it as a phone belonging to Colin Strickland. GrayKey report for this phone being displayed. Over 219 GB extracted from this phone.
Portnoy is going over the call log from Strickland’s phone. Prosecution asks Portnoy if the records show that there was an active call, beginning at 9:07 p.m. on May 11, 2022. Portnoy confirms.
Now seeing a report showing contacts that were saved in Strickland’s phone. Interaction status shows if a number or contact was blocked. We see one row with a ‘blocked’ status, and the associated email appearing to belong to Wilson. Portnoy says ‘Christine Wall’ is not blocked.
Now seeing an entire spreadsheet of blocked contacts from Strickland’s phone. This shows 98 contacts. We previously heard a figure in the 70s during Strickland’s time on the witness stand.
Now seeing photos of a computer Portnoy says belonged to Armstrong. Portnoy touches back on the encryption, which interfered with their ability to extract data.
More phones and photos being shown. Last week, Det. Spitler said he requested 25-30 search warrants in this case, partially for cellphones and technology.
Portnoy says only one phone had multiple SIM cards. An iPhone SE.
Portnoy says one thing was “not normal.” The numbers on one of the SIM cards did not match another element on the phone. However, there is a phone number associated. Portnoy says he found the phone number belonged to a ‘K. Armstrong.’
Portnoy talking about SIM card extraction. He says text messages aren’t actually saved to the SIM card anymore. No stored contacts on a SIM card either.
A Lenovo ThinkPad computer was also examined. Portnoy says it was encrypted and they could not extract data. Portnoy says it belonged to Wilson.
Prosecution: were two of the items actual geolocation data for Moriah Wilson’s phone and Colin Strickland’s phone? Portnoy: Yes.
Geolocation data extracted from Wilson’s phone is 440 pages, Portnoy confirms. Document begins May 11, 2022 12:01:09 A.M. and ends May 11, 2022 11:58:29 P.M. Portnoy confirms over 2,000 data points were collected for that timeframe.
Portnoy does not do phone location analysis in his job. Longitude and latitude are captured.
Portnoy confirms the geolocation data captured from Strickland’s phone was 460+ pages.
Portnoy is describing the screenshots on display, a text message from United Airlines about flight check in. Dated May 10th, indicates flight to Austin. Appears this was captured from Wilson’s data. A similar email being shown. A flight reservation for traveler Anna Moriah Wilson
Looking at data files on the iPhone 11. Dated May 2, 2022. Contains an image of a person on a bike. Portnoy says material saved in cache isnt purposefully saved by the user. Portnoy says very much possible the iPhone 11 was looking at image displayed in the thumbnail on instagram
We’re seeing more data with photo thumbnails, which Portnoy confirms were seen from Instagram and saved in the cache. One, though, is a screenshot. Appears to be itinerary for flight, showing traveler Armstrong going to PHX on May 2, 2022.
One of the photos saved in the cache, shows a photograph of Moriah Wilson.
Portnoy says the owner of the iPhone, whose cache we were just viewing, was Kaitlin Armstrong.
Another data report from Armstrong’s iPhone. Portnoy says image from January 13, 2022 was sent or received from Armstrong’s phone via text. Portnoy describes the photos as individuals at a shooting range.
State pulls up text messages btw Armstrong and ‘Kyle Sanders.’ Nov. 7, 2021. Message from Armstrong reads: “Well today is his birthday. He’s at home with a 24 year old who may or may not have moved to Austin. And I’m in Tulum solo. Mostly practicing sound healing,” more.
Another file - April 8, 2022. Portnoy says looking at file path, this is associated with iCloud. Another file from March 9, 2022. File path indicates image was saved to phone somehow. We didn’t see the photo.
State passes the witness. Defense begins their questioning.
-- Defense -- cross examination --
Jeremy Sylestine, with the defense, says he doesn’t want to confuse Portnoy, but there’s some information that’s, “all over the place.”
Portnoy says he’s careful about saying these explicitly. “Lots of times, even when I’m almost 100% certain, I say most likely.”
Defense asks if data is different than witness testimony.“In a way, it can be more factual,” Portnoy responded.Defense says that Portnoy doesn’t want to be speculative, which he agrees with.
Defense asking about nuance, and whether that’s for Portnoy to suppose. Portnoy says he has limited knowledge outside the data.
Defense references back to presentation about Portnoy’s training and scope of work. That was one of the first things discussed by the state. Defense asks if technology has advanced in terms of what’s available to examiners and consumers. Portnoy agrees.
Defense has Portnoy go over some technical details, like how much memory a computer or phone has, how a terabyte is defined.
Portnoy says it could take years to go through the memory of one device, without exterior help like Cellebrite.
Defense asks if Portnoy is generally very busy. He agrees. Defense: Does DFU have a system in place to allow others in the chain of command to give cases a higher priority?Portnoy: Absolutely.
DFU = digital forensic unit
Portnoy says he has almost 100 cases in his queue at any given moment. He says for a very straightforward case, it could take half a day to look at one device.
Defense asks Portnoy to compare iPads and iPhones. Portnoy says they’re relatively similar, using the same iOS and just as challenging to examine.
Defense asks Portnoy if accounts can be open on two devices, like instagram on a phone and iPad. Portnoy says yes. Defense asks if it’s seamless. Portnoy says he hasn’t tried but it doesn't appear difficult.
Defense wants to ask about iPhones and their location data. Portnoy confirms two from Strickland and Wilson which he created reports for, from May 11, 2022.
Portnoy says how many GPS points are included matters, because it depends on totality.
Defense is going over all of the devices Portnoy attempted to extract data from. Portnoy says he spent months trying to get into the iPhone 11 Pro, saying he didn’t have brute force entry.
15 minute recess
Mid-morning thread on Day 7 of #KaitlinArmstrong trial
Defense is asking about tracking location. Portnoy discussing Find my IPhone. He says that you can log in from another device using iTunes email and potentially find your missing device.
Defense asks if there are other apps to track. Portnoy says yes. Defense asks if during the extraction from Strickland’s phone, he found any such app. Portnoy says no.
Defense says, on the iPhone 11, did Portnoy find any location sharing apps. Portnoy says he did not look through the contents. When asked why, he says because the extraction was already prepared.
Portnoy says he never touched any of the Strava data.
Asking about the tracking points and vehicle movement. State previously had Portnoy describe the route Armstrong’s Jeep took prior to Wilson’s death. Defense asks if Portnoy is an expert of GPS. Portnoy says he is not.
Portnoy says for the purposes of the movement and the data, he had enough to provide his impression. Defense says, “when it comes to how it works, error rates, you’re not expert right?” Portnoy tries to dispute this assessment, and defense circles back to expert status.
Portnoy says that Garmin would have more knowledge than himself when it comes to the error messaging.
Portnoy says it was ‘unlike other extractions’ because had to follow guidance from Berla. Defense clarifies you don’t take apart phones, tablets, etc. Portnoy says not that he’s aware of. Appears they’re discussing the Uconnect.
Defense asks an unsuccessful attempt Portnoy and team performed on the Uconnect was not mentioned during state’s examination. Portnoy says he can’t speak to that.
Defense asks how Portnoy knows a report being shown is not the ‘raw data.’ Portnoy explains the differences in language and format. Portnoy says the only adjustment made was to get it in the right timezone format.
Portnoy says originally the time from the Uconnect extraction data was set to 19.7 years ago. Defense “your solution was, eventually, to seek out help from Berla?”Portnoy: Yes
Defense - before you reached out to Berla, you took points of interest, and reverse engineered, correct? Portnoy - you can call it that.
Defense is asking if Portnoy himself went out to the areas of interest in the case and gathered data for comparison. Portnoy says that he did something like that. Defense “you went back and started from something investigators had already determined was important.”
Defense says Portnoy already drew his conclusion and picked data that supported it. Portnoy says he wouldn’t describe it that way.“What’s the danger in picking and selecting which data is important in an investigation like?” - defense Portnoy disagrees that he ‘selected’ data.
Defense says there’s potential error in the numbers the device is providing. “correct,” Portnoy answered.
Defense says there are concerns with tall buildings, trees, basically interference, when it comes to data with car GPS systems or phones. Portnoy says that there can/could be.
Defense says there are concerns with tall buildings, trees, basically interference, when it comes to data with car GPS systems or phones. Portnoy says that there can/could be.
Defense asks if Portnoy can tell if a phone was moving alongside the car. Pornoy says call logs come close. Defense calls out the non-committal language
Defense asks if infotainment says which device was connected, which door was opened, who was behind the wheel. Portnoy says no.
Defense asks whether a phone has to be powered on to access its functions, then asks if there were particular addresses entered into the system that were extracted. Portnoy says no.
Defense asks if it’s common for APD to hang onto a device involved in a case. Portnoy says yes.
Defense passes witness but state has follow up questions.
Defense is asking about tracking location. Portnoy discussing Find my IPhone. He says that you can log in from another device using iTunes email and potentially find your missing device.
Defense asks if there are other apps to track. Portnoy says yes. Defense asks if during the extraction from Strickland’s phone, he found any such app. Portnoy says no.
Defense says, on the iPhone 11, did Portnoy find any location sharing apps. Portnoy says he did not look through the contents. When asked why, he says because the extraction was already prepared.
Portnoy says he never touched any of the Strava data.
Asking about the tracking points and vehicle movement. State previously had Portnoy describe the route Armstrong’s Jeep took prior to Wilson’s death. Defense asks if Portnoy is an expert of GPS. Portnoy says he is not.
Portnoy says for the purposes of the movement and the data, he had enough to provide his impression. Defense says, “when it comes to how it works, error rates, you’re not expert right?” Portnoy tries to dispute this assessment, and defense circles back to expert status.
Portnoy says that Garmin would have more knowledge than himself when it comes to the error messaging.
Portnoy says it was ‘unlike other extractions’ because had to follow guidance from Berla. Defense clarifies you don’t take apart phones, tablets, etc. Portnoy says not that he’s aware of. Appears they’re discussing the Uconnect.
Defense asks an unsuccessful attempt Portnoy and team performed on the Uconnect was not mentioned during state’s examination. Portnoy says he can’t speak to that.
Defense asks how Portnoy knows a report being shown is not the ‘raw data.’ Portnoy explains the differences in language and format. Portnoy says the only adjustment made was to get it in the right timezone format.
Portnoy says originally the time from the Uconnect extraction data was set to 19.7 years ago. Defense “your solution was, eventually, to seek out help from Berla?”Portnoy: Yes
Defense - before you reached out to Berla, you took points of interest, and reverse engineered, correct? Portnoy - you can call it that.
Defense is asking if Portnoy himself went out to the areas of interest in the case and gathered data for comparison. Portnoy says that he did something like that. Defense “you went back and started from something investigators had already determined was important.”
Defense says Portnoy already drew his conclusion and picked data that supported it. Portnoy says he wouldn’t describe it that way.“What’s the danger in picking and selecting which data is important in an investigation like?” - defense Portnoy disagrees that he ‘selected’ data.
Defense says there’s potential error in the numbers the device is providing. “correct,” Portnoy answered.
Defense says there are concerns with tall buildings, trees, basically interference, when it comes to data with car GPS systems or phones. Portnoy says that there can/could be.
Defense says there are concerns with tall buildings, trees, basically interference, when it comes to data with car GPS systems or phones. Portnoy says that there can/could be.
Defense asks if Portnoy can tell if a phone was moving alongside the car. Pornoy says call logs come close. Defense calls out the non-committal language
Defense asks if infotainment says which device was connected, which door was opened, who was behind the wheel. Portnoy says no.
Defense asks whether a phone has to be powered on to access its functions, then asks if there were particular addresses entered into the system that were extracted. Portnoy says no.
Defense asks if it’s common for APD to hang onto a device involved in a case. Portnoy says yes.
Defense passes witness but state has follow up questions.
- Joined
- Feb 25, 2013
- Messages
- 45,155
- Reaction score
- 463,368
Mills Hayes
@MillsHayesTV
David Portnoy, with the Austin PD's digital forensic unit is back. Any of the devices he couldn't run data on he sent to the US Secret Service. We are looking at iPhone 13 mini that belongs to Moriah Wilson, who was murdered May 11, 2022.
7:21 AM · Nov 13, 2023
We're looking at Moriah Wilson's Cellebrite extraction report from her phone. From 8:37 PM (right after Colin dropped her off at her friends's house) until 9:13 PM she is using text, Instagram, Email & Google Drive. Her phone was actively being used during this time.
7:27 AM · Nov 13, 2023
Looking at Moriah's text messages between her and Christopher Strickland around 4:19PM of the day of her murder. Seems to be asking her to upload photos in Google Drive. At 9:13 PM, Moriah text back, "just dropped some in. Let me know if these will work."
7:30 AM · Nov 13, 2023
State showing cellebrite extraction data of Moriah's phone usage matches up with her text messages sent. Portnoy says a phone is able to collect location data through cellphone towers, wifi points, GPS fixes & from metadata from images. Says metadata from photos is most accurate
7:33 AM · Nov 13, 2023
GPS fixes data is more abundant. Portnoy also extracts data from Moriah's Macbook. Portnoy says there was data on it that appeared relevant but nothing stood out. Moving on to S3 device, iPhone 13 Pro, that belongs to #KaitlinArmstrong. Oddly, device name is iPhone 11 Pro.
7:42 AM · Nov 13, 2023
On Kaitlin's iPhone 13, Portnoy says they got "partial before first unlock extraction." Email associated is [email protected]. Cellebrite extraction report show her phone powers off at 7:30 PM on May 11, 2022 (day of murder) and then powers back on at 9:47 PM.
7:45 AM · Nov 13, 2023
Next iPhone 13 Pro is up. This phone belongs to Colin Strickland. GrayKey Progress Report. Received full file system extraction. He answers a phone call from #KaitlinArmstrong on May 11, 2022 at 4:24 PM, last 3:04 mins. Armstrong calls again at 6:24 pm, not answered.
7:52 AM · Nov 13, 2023
"Allen Able Owner" calls Colin Strickland at 9:07 PM. Call lasts for for 8:58 minutes. Remember shots were fired at 9:15 PM.
7:54 AM · Nov 13, 2023
We see that [email protected] is blocked on Colin's phone. There are messages to Christine Walls, the name Strickland gave Moriah in his phone to not make Armstrong jealous. There are 98 contacts blocked on Strickland's phone.
7:57 AM · Nov 13, 2023
Next item is a pink Macbook that Portnoy was not able to access. Device belonged to #KaitlinArmstrong. Device was encrypted. S8 device is an iPhone SE 2022 version. We see startup screen for device. Portnoy says it either has been factory reset or it was just bought.
8:01 AM · Nov 13, 2023
Appears as if the phone was just bought because there is a new box, along with chargers, etc. Received 2 physical SIM cards. Only phone Portnoy received that had more than 1 SIM card. No backup.
8:07 AM · Nov 13, 2023
Portnoy also received Moriah Wilson's ThinkPad laptop but was unable to extract data from it because it was encrypted.
8:15 AM · Nov 13, 2023
State submits geolocation data from Moriah Wilson & Colin Strickland’s phone on May 11, 2022. Over the span of 24 hours one phone has collected 2,318 data points. Portnoy does not do phone location analysis.
8:24 AM · Nov 13, 2023
First report was from Wilson's phone. Strickland's phone has 2,514 different locations recorded for the day of May 11, 2022. State's 487 is text from United Airlines informing Wilson about flight. Moriah flys from Denver to Austin, May 10, 2022, departing at 1:36PM.
8:30 AM · Nov 13, 2023
Looking at a report of pictures saved in a cache from an Instagram app on May 1, 2022. There is a person on a bike wearing helmet, another b&w pic of Moriah smiling wearing a helmet. Total of 30 image files. The iPhone 11 (Armstrong's) viewed these photos on Instagram.
8:39 AM · Nov 13, 2023
One photo in report is a screenshot of American Airlines flight info for #KaitlinArmstrong from Austin to Phoenix on May 2, 2022. There are multiple photos of Moriah Wilson "saved" in cache from Armstrong's "iPhone 11" phone. This means she viewed them.
8:42 AM · Nov 13, 2023
We're looking at more images & video clips from Armstrong's phone. On January 13, 2022, the phone sends/receives through text photos of Armstrong pointing a gun at a shooting range target. You can only see her back.
8:44 AM · Nov 13, 2023
Instant messages from Kyle Sanders to Armstrong. "How'd that whole thing work out"
8:47 AM · Nov 13, 2023
KA responds Nov. 7 "well today is his birthday. he's at home with a 24 year old who may or may not have moved to austin and i'm in tulum solo. Mostly practicing, sound healing, meditating. teaching some. Heading to massage now then temezcal ceremony for a detox and rebirth"
8:47 AM · Nov 13, 2023
On April 8, 2022, there is a photo from icloud. I think it's a half-naked woman in front of a mirror, but I can't tell. They don't zoom in on photo. Based on file path, image was saved to phone on March 9, 2021
8:51 AM · Nov 13, 2023
Portnoy says VPN is a virtual private network that creates more privacy for someone. Prevents other entities, hackers from seeing personal info. State passes witness. Defense is up. Defense attorney Jeremy Sylestine is doing the questioning.
8:54 AM · Nov 13, 2023
Sylestine asks about the 30 images report showing Armstrong looked at photos of Wilson on May 1, 2022. Sylestine asks why Portnoy says it is "Very much possible" the iphone 11 was looking at Instagram.Portnoy says, "I'm always careful in explicitly saying everything is 100%"
8:55 AM · Nov 13, 2023
Sylestine asks about the "scantily clad" woman in the photos. She was wearing shorts/pants and a bra. Asks about if knows the context. Portnoy says no, he knows very little about case. Now we're pulling up Portnoy's qualifications.
8:57 AM · Nov 13, 2023
Portnoy says he is a digital examiner for most part. Sylestine asking about technology advancing in digital forensic units. S: Same goes for laptops, tablets. would you agree?P: YesS: Someone in your position is encouraged to use Cellebrite to parse it & look through?P: Yes
9:01 AM · Nov 13, 2023
S: With regard to APD's capacity to do this work, are you generally very busy?P: We arePortnoy says supervisors can upgrade status of a device in a case to a standard to a more urgent matter, depending on urgency of case.
9:06 AM · Nov 13, 2023
Portnoy says iPad and iPhone are basically the same, just as challenging to extract data for each. S: There's really a wealth of info that is available in the devices that we may not even think about until were in it forensicallyP: Yes
9:13 AM · Nov 13, 2023
Sylestine says let's talk a little more about iphone & location. Phones for CS & MW show location data Portnoy created reports for. Seems to come from May 11, 2022. Portnoy says there are multiple ways to get GPS data. Sylestine seemingly trying to shed doubt on phone GPS data.
9:18 AM · Nov 13, 2023
We are back from a break. Sylestine still questioning Portnoy about examining devices. Report for iPhone 11 showing power off at 7:30PM and power on at 9:47PM. Portnoy says he can't say if someone purposely turned off phone or not.
9:49 AM · Nov 13, 2023
Portnoy talking about find my iPhone and how you can login and see other people's location if they share location with you. Someone has to enable it. Could not find any location sharing apps on Colin Strickland's phone. Portnoy says he did not look through iPhone 11 for this
9:55 AM · Nov 13, 2023
Sylestine asking about Armstrong's DPS data showign her circling Caitlin Cash's apartment prior to murder of WIlson. Defense asking about data showing the jeep going over lots. Sylestine: Are you an expert on GPS and its function?Portnoy: I am not
9:58 AM · Nov 13, 2023
Portnoy says he has received comprehensive experience with GPS data. Sylestine saying someone from Garmin would be a better expert to talk about GPS data. Garmin created infotainment center in Armstrong's jeep.
10:03 AM · Nov 13, 2023
Portnoy says GPS data was unlike other extraction because they had to use Berla to facilitate connection to actual chip. Portnoy says he looked at where jeep was last used in Carmax. Looked at GPS data to see if it coincided.
10:10 AM · Nov 13, 2023
Portnoy says he doesn't know if he "selected" relevant GPS points, but found them. Garmin has a general rule of estimation of accuracy. S: There is potential error in the number that this device is providing?
P: Yes
S: Gps, not a perfect system?
P: Not perfect
10:15 AM · Nov 13, 2023
Portnoy speed is a derivative of getting the GPS signals, time. Speed calculated from one point to another. Talking about phone tracking another location. S: Has to be own for those things to happen? P: Yes. Cannot tell if there are particular addresses entered in GP
10:21 AM · Nov 13, 2023
Witness passed. Portnoy says he doesn't decide which devices he is able to get into. Decided by detective, DA or owner of device. Portnoy says GPS data is reliable.
10:32 AM · Nov 13, 2023
State asks if there are multiple scenarios were it’s not legally allowed to extract the data. Portnoy says that’s correct.
State is asking about changing the date in the extraction data. Portnoy says every single track point, and the entire extraction, was calibrated with the correct times and dates.
State is asking about changing the date in the extraction data. Portnoy says every single track point, and the entire extraction, was calibrated with the correct times and dates.
@JessicaTaylorTX
State asks what Portnoy is representing with the animation of the blue line, which he says it’s just a video of how the points progress.
1:40 PM · Nov 13, 2023
State asks what Portnoy is representing with the animation of the blue line, which he says it’s just a video of how the points progress.
1:40 PM · Nov 13, 2023
- Status
Similar threads
- Locked
- Locked
- Locked
Online statistics
- Members online
- 98
- Guests online
- 2,697
- Total visitors
- 2,795