Kelsey Guay — Direct/Cross/Redirect/Recross
390 linesJUDGE EVERETT: Please call your next witness.
MR. ZELMAN: The next witness is Kelsey Guay. We might need a few minutes to set up the presentation.
JUDGE EVERETT: That's fine. Members of the jury, the bailiff will take you to the jury room. We will at that time hear from the next witness.
JUDGE EVERETT: Everyone can be seated.
JUDGE EVERETT: Please bring in the witness so they can get their computer or other matters set up.
JUDGE EVERETT: Please raise your right hand.
JUDGE EVERETT: Do you swear or affirm the testimony you're about to give will be the truth?
KELSEY GUAY: I do.
JUDGE EVERETT: You may take your seat. Can you speak loudly and clearly for the jurors?
JUDGE EVERETT: You may examine.
MR. ZELMAN: Good morning. Can you please introduce yourself to the jury?
KELSEY GUAY: My name is Kelsey Guay and I'm a senior digital forensic examiner.
MR. ZELMAN: And where are you currently employed?
KELSEY GUAY: I'm currently employed by Roloff Digital Forensics, which is a small private company based out of Spokane, Washington.
MR. ZELMAN: And tell us a little bit about your background and training in the area of digital forensics.
KELSEY GUAY: Sure. So, starting at the beginning, I graduated from Portland State University with my Master's of Criminal Justice in 2016.
KELSEY GUAY: During that time, when I was in grad school, I worked for the Clackamas County Sheriff's Office in their Family Justice Center, which is a domestic violence clinic.
KELSEY GUAY: After graduating grad school, I became employed with the Portland Police Bureau, which is in Portland, Oregon.
KELSEY GUAY: I was employed as an investigative crime analyst. So for about three years, I supported the entire detective division, and I worked on anything from call detail records, mapping cell site location, developing frequency analysis, looking at pattern of life. I would also help them review search warrant returns — things like when they get data back from Google, Facebook, Twitter, Instagram, Snapchat — and I would do some open source, just looking at people's profiles online to help in active investigation.
KELSEY GUAY: After that, I was the ICAC analyst, and ICAC stands for Internet Crimes Against Children.
KELSEY GUAY: So during that time, I performed phone extractions. I went on scene to search warrants where there was an internet-crimes-against-person suspect. I would do RAM captures and router examinations. I would also review every single cyber tip and any search warrant returns that came back for those cyber tips.
KELSEY GUAY: After that, I was the digital forensics lab manager. They civilianized the unit. I was a civilian employee my entire time with the police bureau. And so for about the last — a little under two years — I managed the digital forensics lab, where I would perform extractions, and I led a team of five examiners in doing digital forensic extractions and analysis.
MR. ZELMAN: Can you tell us approximately how many hours of training have you had specific to the review and analysis and interpretation of call detail records and cell site location information?
KELSEY GUAY: I have a general 400 hours of training just related to all kinds of things — digital forensics, CSLI, cybersecurity.
KELSEY GUAY: If I had to guess, I would say maybe 100 hours dedicated to cell site location information.
MR. ZELMAN: And with respect to call detail records and cell site location information, how many sets — over the course of your career — of call detail records have you reviewed for casework, like actual files?
KELSEY GUAY: I don't have an exact number. I would say close to a thousand, if not over. Some of the cases I work on can have ten or more phone numbers, so each case can get quite expansive pretty fast. So I would say, yeah, maybe roughly a thousand different sets of records.
MR. ZELMAN: And with respect to mapping of call detail records, can you tell the jury approximately how many times you've had to map cell site location information from call detail records?
KELSEY GUAY: Sure. I would say maybe about half. When I was working in law enforcement, they don't always get location information for a call detail record — sometimes they just get records without mappable location information and they want, like, a frequency analysis, looking at patterns before an event of interest. So I would say I probably have half of the records I've reviewed.
MR. ZELMAN: Have you previously offered testimony in court concerning this subject matter?
KELSEY GUAY: I have.
MR. ZELMAN: And have you previously been qualified as an expert in digital forensics specific as to cell site location and call detail records?
KELSEY GUAY: In Oregon it's a little bit different, but in at least one they did provide me as an expert. Most of it was my employment at the police bureau.
MR. ZELMAN: At this point, Your Honor, I would tender the witness.
JUDGE EVERETT: Does the state wish to voir dire the witness as to her training or experience?
MS. DUGAN: No, sir.
JUDGE EVERETT: Is there an objection to her ability to provide an opinion in the field of digital forensics?
MS. DUGAN: No, sir.
JUDGE EVERETT: Members of the jury, while this witness testifies, she will be permitted to provide you with an opinion in the field of digital forensics. You may continue.
MR. ZELMAN: Thank you, Your Honor. Ms. Guay, in this case, did you review call detail records that were provided or obtained by law enforcement?
KELSEY GUAY: I did.
MR. ZELMAN: And specifically, can you tell the jury what records you reviewed?
KELSEY GUAY: So when I started working on this case, I was given a lot of different data, just so that I could see everything that had been obtained by law enforcement. However, my focus was on Donna's cell phone records, so that's where I kept most of my focus — on her records. However, I reviewed all of the data. So essentially there's a lot of AT&T records encompassing various time periods, some of them duplicates of the same time period. There are also Sprint records — I think there was also some Verizon and T-Mobile records. So there's a lot.
MR. ZELMAN: Now, we did not provide you with the tower dumps. We provided you specifically with the records of the individuals that were obtained by law enforcement, correct?
KELSEY GUAY: Correct.
MR. ZELMAN: From a company like AT&T, T-Mobile, related to a specific phone number.
MR. ZELMAN: Did you also review any testimony that has been provided in the past by Sergeant Corbitt?
KELSEY GUAY: Yes.
MR. ZELMAN: Specifically, what sets of testimony did you review?
KELSEY GUAY: Um, there was — I guess from this trial — two PDFs that I was given discussing testimony from this trial. I think there was also potentially other testimony from previous events that I skimmed because it wasn't necessarily relevant to what I was asked to look at.
MR. ZELMAN: Were you provided in those — were you provided call detail records that included cell site location for Harvey Adelson?
KELSEY GUAY: I was.
MR. ZELMAN: And specifically for Donna Adelson?
KELSEY GUAY: I was.
MR. ZELMAN: And Charlie Adelson?
KELSEY GUAY: I was.
MR. ZELMAN: Were you also provided with a PDF of a PowerPoint that was prepared by Sergeant Corbitt?
KELSEY GUAY: I was.
MR. ZELMAN: What were you asked to review related to this PowerPoint?
KELSEY GUAY: So to just look through all of it. There was about 350 slides, so I kind of went through it side by side, but my specific focus was on slides 26 and 28, which were charts of a frequency analysis.
MR. ZELMAN: Would it be helpful to the jury to see specifically what you reviewed in the work that you performed?
KELSEY GUAY: I believe you guys have probably seen this already, but yeah, it might be helpful to have a visual.
KELSEY GUAY: Do you want me to do the present?
MR. ZELMAN: Yes, please.
MR. ZELMAN: If you go back a couple slides please — I'm sorry, to the beginning. Yes. So what are we looking at here?
KELSEY GUAY: So this is a screenshot of the folder that contained the document that I focused my analysis on, because this document was related to Donna's cell phone number, or records. In this document, after reviewing all of the different ones, I realized that this document contained the most data. It started — the records started January 1 of 2014 and they went through May of 2017, so it contained both time sets that we're seeing on slides 26. Additionally, this data contains seconds in the timestamp. And so, me as an analyst when I'm looking at CDR documents, I always prefer to get the document that has the most information — and in this case, to have a timestamp that includes seconds.
MR. ZELMAN: Why is that important?
KELSEY GUAY: It's important for different reasons depending on the case. If you are very interested in building, like, a chronological timeline — having seconds, right, because we have 60 seconds in one minute — so if your call detail records only show you the minute and not the second, things could be coming in showing the same minute but you don't actually know which happened first without the second timestamp. So different reasons why it can be important. And in that same note, I think your next slide shows what you obtain when you open up this file, correct?
MR. ZELMAN: Can you show that to the jury, please?
KELSEY GUAY: I can. So, you might have also seen something similar to this earlier in this trial, but this is what that document looks like when you open it up. This is just the first three rows, because this document, like I said, goes through 2017. There are a lot of rows in this document, so this is just a glimpse of what it looks like when you open it up in a text document, which is the native format.
KELSEY GUAY: This is not very easy to work with as an analyst. You could take this and you could put it into an analytical program and run some calculations on it. However, when I looked at this in a little bit more detail — and there are slides — I realized this data was kind of messy. And by "messy," I mean I wouldn't necessarily just trust putting it into a program and trusting the numbers that came out. So I took this document and put it into Excel.
MR. ZELMAN: The programs that you're describing that this data could be put into — are those referred to as tools?
KELSEY GUAY: Yes.
MR. ZELMAN: Okay. And so, since this was messy, how did you import this into Excel?
KELSEY GUAY: So when you open up Excel — I don't know how many of you are familiar with Excel; I live in Excel, so I'm very familiar with it — but one of the options when you open Excel is, there's a data option, and you can import data.
KELSEY GUAY: There's a little tool that helps you bring in text files into Excel.
KELSEY GUAY: And this one is a great one to bring into Excel because — it might be hard to see, but there are commas between each of these values. So this is what's known as a comma-separated type file, so it translates very nicely into Excel.
MR. ZELMAN: Can you show the jury how that looks when you put it into Excel, please?
KELSEY GUAY: I can. So this is that exact same first three rows, and this is what it looks like in Excel.
MR. ZELMAN: How does the software — does Excel know how to separate those three lines into making this correctly?
KELSEY GUAY: So essentially, there's, like, a little walkthrough tool when you import data into Excel from a text file, and it will show you a preview: "Is this what your data should look like?" And you can say, "Yep, it's using a comma; it's displaying correctly."
MR. ZELMAN: Is there anything that you have to do with the times to adjust them for Eastern time?
KELSEY GUAY: Yes. So this specific file — again, probably very small — but in column two, or B, the header says "Connect Date Time UTC." So this is very common for call detail records to come in UTC, and if they explicitly say UTC, you know it's UTC. So for these records, the times of interest were in the summer, so I knew that this would be in Eastern time, so I was able to add a column in Excel — again, very easy to do this in Excel. Add a column, write a quick formula, do that time conversion so that I could make sure that — because if you have a call that's in UTC, it might be showing on a different day. But if it kind of happens within that, you know, plus or minus four window of when days change, I wanted to make sure I was looking at the right dates for Eastern time.
MR. ZELMAN: And then once you did this for what data?
KELSEY GUAY: I did this for Donna's records — the file that we had identified on that very first slide.
MR. ZELMAN: Okay. And then did you also do similar analysis for Charlie's call records?
KELSEY GUAY: Um, I looked at his phone records. I did not go quite in depth as what I did with Donna's, but I did look at his in Excel as well. And I believe the next slide is that frequency chart.
MR. ZELMAN: I know the next slide is essentially an example of kind of the messiness that I was referring to earlier. Can you show the jury that, please?
KELSEY GUAY: Yes, of course.
KELSEY GUAY: Would you like me to explain?
MR. ZELMAN: Yes, please. What are we looking at now?
KELSEY GUAY: Okay. So this is that exact same document. Now, instead of just looking at the first three rows, we're looking at rows one through nine.
KELSEY GUAY: And this is at the very top of the document. So as I look — as I open up any kind of call detail records — I want to see, get an idea of what the data contains.
KELSEY GUAY: So in this example, that red box is just showing three unique rows of data.
KELSEY GUAY: But when I look at these three unique rows, I see a couple of things that indicate to me that these three unique rows might all be referring to the same one call event. And by call event, I mean like an incoming or outgoing call.
KELSEY GUAY: So if a program takes this, it might see this as potentially three different call events, whereas me, as a human, I can realize, oh, there's indicators that tell me that this is one call event.
MR. ZELMAN: Is there a certain way you can zoom in on that a little bit, not in the presentation mode? Okay, if you could back out of the presentation mode and zoom in so that the jury can see what you're talking about, please.
KELSEY GUAY: I will do my best.
KELSEY GUAY: I don't know if this is getting any better or worse.
MR. ZELMAN: Okay. So the top line that we're looking at there on line 6 — what does the data from that line of call detail records tell you?
KELSEY GUAY: So essentially when I look at row 6, I see the connect date time, which is when the call was initiated, whether it's an incoming or outgoing call. I see a few things. I see the seizure time, which is the time it takes for the network to set up the call; the elapsed time, which is ET.
KELSEY GUAY: That's how long the phones would have, quote-unquote, "connected."
KELSEY GUAY: I see the originating and terminating number.
KELSEY GUAY: So — oops, a little too far.
KELSEY GUAY: Originating number — so the call that it was started on; terminating, the phone number that the call was ending on. And then because this is a screenshot of Donna's phone records ending in 0997, we also see the IMEI and IMSI. Those are just the — it's like a VIN number for a phone. It's an IMEI — International Mobile Equipment Identifier. And then the IMSI is the International Mobile Subscriber Identity. I mean, that's how the network can tell that you are allowed to be on their network, right, and make calls on the AT&T network. We also see the call type, CT; "mobile terminating" is what that MT stands for. So again, it reinforces the fact that we see Donna's phone number in the terminating column, and then it's reinforced by that MT.
KELSEY GUAY: In the "feature," this is unique to AT&T records.
KELSEY GUAY: So this is some random — they look like maybe random letters, but they all have meanings. And there's a record key that, if you're not super familiar with what those letters mean, you can go and look at that record key. But essentially what this is saying in human speak is that the number calling — there is "number identity present," that's that NIP; there's the CN or CFNA, which is call forwarding — it wasn't available, that it couldn't reach the other party. And then you see that VM, which just means voicemail was involved in this transaction.
MR. ZELMAN: So the next line — so the features — what does that tell us about this call?
KELSEY GUAY: It tells me that there was an incoming call to Donna's phone, and it was sent to voicemail.
MR. ZELMAN: Okay. And what does the subsequent two lines indicate?
KELSEY GUAY: So the next two lines are related to this initial call event. So I can see that this next one has voicemail. I also can see that this is the forwarding number, which is to forward it to the voicemail box. And then if I go all the way back, the SO and the ST are "service originating" and "service terminating" — so these are not human-generated, these are network-generated logs. So that's what the SO and ST stand for. And then if I go back and I look at the times, the thing I notice is that for those following two service calls, the timestamps are the same. And all of this — so while the connection time is what would be 2:52 PM, that's when the call would have come into her phone and gone to voicemail. Then the second two with the identical timestamps are essentially just multiple legs of that activity. So as a human, I can see that these three lines are all related to one event — an incoming call that was routed to voicemail.
MR. ZELMAN: If you can go back to the presentation mode, please. And then let's look at the next slide.
KELSEY GUAY: So this is slide 26 that I referenced at the beginning of my testimony. So this was one of the things that they had asked me to specifically review. And the number that's highlighted —
MR. ZELMAN: Whose number is that?
KELSEY GUAY: I believe that is Donna's phone number.
MR. ZELMAN: And according to the state's slide 26, how many times — well, what's the time period of these records, of this chart?
KELSEY GUAY: So each phone number has a slightly different time period, but for this particular phone number, the date range was May 2nd, 2014 through July 20th, 2014.
MR. ZELMAN: And according to the tool that was used by Sergeant Corbitt, how many times did Charlie Adelson's device attempt to communicate with Donna Adelson's device?
KELSEY GUAY: So it's my understanding that this would contain both, right — both directions, Charlie calling Donna, Donna calling Charlie — and both connected and attempted, right? So if it's a voicemail, or if it actually had an elapsed time of, you know, let's just say a minute — right, so this would theoretically contain all of that activity. So based on this chart, it appears that this tool said that there were 417 unique communication events.
MR. ZELMAN: Did you take any steps to verify the accuracy of this number?
KELSEY GUAY: Yes. So because this slide particularly was focused on or created using Charlie's phone records, I went through all of those files that we had described earlier and tried to see if I could find any one particular file for Charlie's phone records that contained this entire time span — May 2nd, 2014 through July 20th, 2014. Again, going back, there were a lot of different records for this case. I couldn't find one specific file that encompassed this entire time frame. I did find three different files for his cell phone number, so essentially I had to take three different files to try to recreate this. And when I was doing that, I noticed that at least between two of the files, there were a few dates that overlapped, right? So when law enforcement gets a call detail record return, they'll ask for specific dates. So for example, you might ask for May 1 through June 20, and that would be one return; and then on another date, you do another warrant or subpoena, and you ask for June 18th through July 18th, right — a month's worth of data. So when I found these three files, I noticed that there were at least two files that had some dates overlapping.
MR. ZELMAN: Did you remove the overlap when you conducted this manual examination?
KELSEY GUAY: I did. And the other thing I noticed was that out of the three files, two of them were in local time — so Eastern time — and then one of them was in UTC. So again, I had to try to see if I could make this a continuous May 2nd through July 20th, taking out any overlapping dates and making sure again that the dates were all correct by seeing everything in Eastern time.
MR. ZELMAN: What did you do? Did you try to recreate this chart that Sergeant Corbitt prepared?
KELSEY GUAY: I did try to recreate by how I just explained.
MR. ZELMAN: And were you able to?
KELSEY GUAY: I wasn't able to come up with 417.
MR. ZELMAN: Can you explain to the jury what you did beyond what you've already described and what number you got to?
KELSEY GUAY: So I did two different steps. I did the one that I just explained, where I converted everything to Eastern time, ensured that there were no dates overlapping, and so that it was essentially just showing me, you know, May 1 through July 20.
KELSEY GUAY: Um, and I think when I did that and I took out these extra overlapping dates, um, and then I filtered to just only look at the incoming and outgoing calls — um, I did not deduplicate at all, um, that what I just explained, right, where I said that three rows for potentially one event — did not duplicate. I just put a filter for Charlie and Donna's cell phone numbers. And at that point, for these dates, I think I got maybe 383 unique call events.
KELSEY GUAY: And that was again taking out the overlapping dates. The second step I did was — I thought, well, maybe the tool didn't do that and it just took everything and it didn't deduplicate the dates. So I tried it again and I got 393 when I did not take out any extra dates. So — and these were just calls, I was only looking at calls, and these were —
MR. ZELMAN: Did you do anything to determine whether or not these events went to voicemail?
KELSEY GUAY: I did not.
MR. ZELMAN: Okay. Did you take this a step further to determine whether or not there were actual communications versus actual or attempted — sorry — Can you — sorry, it's a poorly worded question. Um, so the 393 that you identified is both connected and attempted, correct? Is there a way to determine whether or not, um, something is, uh, attempted versus connected aside from the voicemail flags that we talked about a few moments ago?
KELSEY GUAY: So the voicemail flags are going to be the best indicator of if somebody didn't connect, because AT&T is telling you that the phone call went to voicemail. So as an analyst, that's to me the best indicator. Another indicator that you can use — I think different people have different thoughts on this — but if it's a very short duration, like let's say under 10 seconds, could the phones have connected and there's just actually no communication? Or it may be, you know, you answer but you don't hear anything, and you hang up. So different analysts will use different amounts of elapsed time to determine, like, you know, I think some people will say everything over 30 seconds indicates there was, you know, actual communication. So people have different thoughts on it. But I like to see, you know, if it's two seconds to zero seconds, there probably wasn't any actual communication.
MR. ZELMAN: Now, when reviewing specific to Charlie's records, did you then go back and dedupe everything to determine the actual and attempted calls?
KELSEY GUAY: I did not for Charlie's records.
MR. ZELMAN: Let's talk about Donna's phone records, if we could advance to that, please. So this is slide 28.
KELSEY GUAY: Okay.
MR. ZELMAN: And according to this, what was the time period of this chart?
KELSEY GUAY: So this chart is focused on — would have been created using Donna's call detail records. And the contact at the top that's highlighted is Charlie's cell phone number. And the date range that was used to generate these records was June 23rd, 2014 through July 22nd, 2014. Again, I did the same process like I did with Charlie's. I went to go look through all the data to see if I could find a file that would cover this date range and only this date range, and I was able to find a file that covered this date range.
MR. ZELMAN: And when you went through the process that you've already explained — manually going through the records — were you able to determine how many unique call events took place during this time between Donna and Charlie?
KELSEY GUAY: So for this one, I took the original file that I mentioned and I just looked at the filters between Charlie and Donna's phone numbers, and I was able to recreate the 80 when I just looked at the totality of the data. Taking a step back, all the way back to that slide one, I mentioned that the record for Donna contains data from 2014 through 2017. So that particular document covered both of the time frames — it covered this one, which is June 23rd through July 22nd, 2014, and it covered what was in Charlie's records, which was May 2nd through July 20th. So I used that document that I showed you guys at the very beginning to dedupe. So I went through that document, I put the filters for Charlie and Donna's phone numbers, and then I went through each line during those time frames to determine, like, is this a voicemail activity? Is this just AT&T duplication?
KELSEY GUAY: Is this an actual unique call event? So that was the document that I used, focusing on these two parties' phone numbers. And I went through each line, line by line, and removed manually any rows that I believed to be referencing the same call event. So when I did that, I got — for this time frame deduplicated, and this would be attempted and connected, right, so it's including the voicemail; it's just noting that there's only one line for that voicemail, not potentially three — I got 69 unique call events that would be connected and attempted.
MR. ZELMAN: So the failure to manually go through these records resulted in an overinflated report in these frequency reports?
KELSEY GUAY: Yes.
MR. ZELMAN: Now, in addition to this data — I don't think we have any more slides.
KELSEY GUAY: No, we do not.
MR. ZELMAN: In addition — to this part of the data, did you also review cell site location information for Donna Adelson's phone, specifically on July 18th of 2014?
KELSEY GUAY: I did.
MR. ZELMAN: And did you identify the cell phone towers that likely provided coverage to Charlie Adelson's home on July 18th of 2014?
KELSEY GUAY: The towers that he could have been connected to from his residence. So I was not provided with an AT&T master cell site list, but I mapped the records for July 18th that are available in the AT&T documents.
MR. ZELMAN: Who has access to the master records?
KELSEY GUAY: Law enforcement.
MR. ZELMAN: So presumably law enforcement would have gotten those records and taken a look at what cell site, what towers and sectors would correspond to Charlie Adelson's residence. Correct. Okay. And in your review of the records — the call detail records that were provided to you, obtained by law enforcement — did Donna Adelson's handset ever connect to a tower that could provide coverage to Charlie Adelson's home on July 18th of 2014?
KELSEY GUAY: No. No.
MR. ZELMAN: With those same records, was there any instance on July 18th of 2014 where Charlie Adelson's handset and Donna Adelson's handset were connecting to the same tower?
KELSEY GUAY: No.
MR. ZELMAN: Nothing further, Your Honor.
JUDGE EVERETT: Cross-examination.
MS. DUGAN: Do you disagree with any of the mapping of the cell site locations from Sergeant Corbitt's presentation?
KELSEY GUAY: No.
MS. DUGAN: Now we saw, on the section of his report, where it shows a travel analysis of Donna Adelson the night of Dan Markel's murder. Do you remember that?
KELSEY GUAY: The ones where there's like projected travel paths?
MS. DUGAN: Correct.
KELSEY GUAY: I do remember that.
MS. DUGAN: Okay. And you don't disagree with the fact that her phone was communicating with the cell site in North Miami at 8:35 p.m., and you don't disagree with that site or sector that he mapped there, right?
KELSEY GUAY: Correct.
MS. DUGAN: And you don't disagree with — on the following slide — that the next time she has location in her cell records is at 10:57, and you don't disagree with that cell site or sector that he mapped, right?
KELSEY GUAY: Um, so I think the 10:53 — I'm sorry, 10:53, thank you — was actually Harvey's cell phone. Um, but if they're presumably in the same vehicle, uh, the tower and sector is correct.
MS. DUGAN: Okay. So for the location south of Charlie's residence and the location north of Charlie's residence that we have location for, you do not disagree with that?
KELSEY GUAY: No.
MS. DUGAN: Okay. And the iMessage where she says "outside your house" — would you expect to have location for iMessages?
KELSEY GUAY: Uh, if it's from an iCloud return, um, no, I would not expect there to be location information from iCloud.
MS. DUGAN: Okay. So I just want to be clear — it's not that we do have location for "outside your house" and it's not consistent with Charlie's house. It's just that we don't have location at all for "outside your house."
KELSEY GUAY: Correct. There is no location.
MS. DUGAN: But Donna Adelson says her location in that message, right? There's the text message from the iCloud.
KELSEY GUAY: Correct.
MS. DUGAN: Where she says "outside your house."
KELSEY GUAY: Correct. That's the contents.
MS. DUGAN: Okay. Okay.
MS. DUGAN: Um, when — you looked at Donna Adelson's records, was there a phone call between Donna Adelson and Annie Cunningham on the evening or night of July 18th, 2014?
KELSEY GUAY: I'm not familiar with that name.
MS. DUGAN: You're not familiar with the name Annie Cunningham?
KELSEY GUAY: No.
MS. DUGAN: Okay. What if I gave you her number? Would you be able to look and see?
KELSEY GUAY: I don't have the call details memorized.
MS. DUGAN: So do you have them with you? The original documents?
KELSEY GUAY: I do up top.
MS. DUGAN: Okay. Yeah, would you be able to look and see?
JUDGE EVERETT: The objection is overruled. Ms. Guay, if you need the question repeated for you, Ms. Dugan will do so.
MS. DUGAN: Do you mind pulling up your call detail?
MS. DUGAN: Let me know when you're ready and I'll give you the number.
KELSEY GUAY: It's a fairly large file, so it'll take a second to load.
MS. DUGAN: If it needs time to load, I can ask some other questions and come back to this.
MR. ZELMAN: Your Honor, I would just ask that if we're going to provide the photo, that we not do it so that it can be published to the media.
JUDGE EVERETT: That's fine. Ms. Dugan, please handle your question on this matter discreetly so her phone number is not published today. I'm watching.
MR. ZELMAN: Thank you, Your Honor.
KELSEY GUAY: I'm just going to filter to that date.
JUDGE EVERETT: You can approach the witness and show her anything that she may need to read concerning this matter.
MS. DUGAN: So am I showing you a contact with Annie Cunningham?
KELSEY GUAY: Correct.
MS. DUGAN: Okay. And you don't need to say the number out loud, but is there a number next to it that begins with 845?
KELSEY GUAY: Correct.
MS. DUGAN: Okay. 845 being the area code?
KELSEY GUAY: Yes.
MS. DUGAN: Okay. That's the number we're looking for.
KELSEY GUAY: Okay.
MS. DUGAN: And my question was, was there a phone call between Donna Adelson and Annie Cunningham the evening — p.m. on — on the 18th of July, evening or night?
MS. DUGAN: And to reiterate, it started with eight, four, five.
KELSEY GUAY: Okay. Yeah.
KELSEY GUAY: I don't... I see the number, and I looked at the records for the evening of the 18th, and I do not see a call to that number.
MS. DUGAN: Okay. And that would be like in the afternoon, evening, or night that night?
MS. DUGAN: July 18th of 2014.
KELSEY GUAY: So, starting from noon to noon on the 18th through midnight on the 18th. I don't see a call to that phone number.
MS. DUGAN: Okay. Thank you.
MS. DUGAN: All right, so we saw your presentation where one slide was kind of showing us what the raw records looked like, right?
KELSEY GUAY: Correct.
MS. DUGAN: And the next slide was showing us an example of how a duplicate event looks. It can look like three entries, but it's actually one event, right?
KELSEY GUAY: Correct.
MS. DUGAN: And then we saw Sergeant Corbitt's frequency reports for Charlie Adelson and Donna Adelson, right?
KELSEY GUAY: Correct.
MS. DUGAN: Okay. What is the purpose of a frequency report?
KELSEY GUAY: There's a lot of different purposes. So when I worked in law enforcement, I would do them for lots of different things. One of the things that you can do is just see who's the number one caller for a particular person — sometimes that's a significant other or family member. So that's one reason you can do a frequency analysis. Another is just to do more of a pattern of life and look at activity over a matter of days, months, years.
MS. DUGAN: Is another reason like to show a relationship between two parties — whether there is one at all, and if there is one, how often they talk?
KELSEY GUAY: Yeah, that's definitely a reason.
MS. DUGAN: In comparison to the other people they talk to?
KELSEY GUAY: Correct.
MS. DUGAN: Do the frequency reports in Sergeant Corbitt's presentation that we saw in your presentation — do those accurately reflect the call detail records?
KELSEY GUAY: Uh they represent the raw data accurately, correct.
MS. DUGAN: Right. They represent the raw data of the records accurately.
KELSEY GUAY: Correct.
MS. DUGAN: And do they accurately reflect that Charlie Adelson is Donna Adelson's most frequent contact?
KELSEY GUAY: For that particular time span of June 23rd through July — I think it's the 22nd — yes, ma'am. Correct.
MS. DUGAN: Okay. It's just that in Corbitt's frequency reports, those are the raw records without duplicates taken out, right?
KELSEY GUAY: Correct.
MS. DUGAN: When you reviewed his — and, well, let me show you this.
MS. DUGAN: I'm going to show you from 73A, slide 20.
MS. DUGAN: Are you familiar with this slide of the presentation?
KELSEY GUAY: Uh I might have seen it at some point.
MS. DUGAN: Would this be a representation in Sergeant Corbitt's presentation of three entries that are actually one event?
MS. DUGAN: Like a duplicate event.
KELSEY GUAY: Potentially. I mean, I would like to see the feature flags or the call flags, but yes — based on the timestamps, the minutes (there's no seconds in this), it does appear that this looks like a phone number is calling a phone number, it's being routed to what I know to be like an AT&T voicemail routing number, and then I see the first two numbers replicated.
KELSEY GUAY: Again, I don't see, like, the call type or the feature flags, but it does appear to be a three-in-one incident.
MS. DUGAN: Okay. And when you reviewed Sergeant Corbitt's testimony from this trial, did you review a portion where he explained that call we just saw, what a duplicate is, and that his frequency reports did contain duplicates?
KELSEY GUAY: Yes, there was some testimony that I reviewed that he did say that there were voicemail routing events that could show us more than one line.
MS. DUGAN: Okay. When we see throughout that presentation — when we see the call detail records for a particular day, let's just say the day of the murder in this case, July 18th, 2014 — those summaries, the duplicates have been taken out, right?
KELSEY GUAY: Are you talking about, like, the slides that have just like the different rows?
MS. DUGAN: Yes.
KELSEY GUAY: For significant events in the case?
MS. DUGAN: Correct.
KELSEY GUAY: Yes.
MS. DUGAN: Um. And if you take out — if you were to go through that frequency report and you only took out the duplicates for, like, for Donna's records, for Charlie and Donna communicating, right?
KELSEY GUAY: Correct.
MS. DUGAN: If you were to go through that frequency report, though, and take out all the duplicates across the board, it would reduce the total amount of communications for each contact, right?
KELSEY GUAY: Correct.
MS. DUGAN: Okay. But it wouldn't change the frequency ranking of each contact.
KELSEY GUAY: I'm not entirely sure about that, because — as I mentioned the first one, when I was trying to recreate Charlie's, there were three different documents, and at least two of the documents had, like, dates that overlap. So I'm not sure, because you would have to also take out, like, the extra for those dates, so that might change the numbers slightly.
MS. DUGAN: If it did, it would be slight, though.
KELSEY GUAY: Yeah.
MS. DUGAN: Okay. And your testimony was that for Donna Adelson's frequency analysis just with Charlie Adelson, instead of 80 events, she actually had 69 when you take out the duplicates, connected and attempted — connected and attempted. Okay. What do you think that shows that's helpful to the defense in this case?
KELSEY GUAY: Um, I think it just goes to when I look at records, I like to be precise with my numbers.
MS. DUGAN: Okay. And when Sergeant Corbitt testified, he did let the jury know that this contains duplicates, though, right? For the frequency report?
KELSEY GUAY: I think he said that it does include voicemail forwarding events.
MS. DUGAN: Okay. So what I'm trying to say is, he didn't say anything that was unreliable or inaccurate with that.
KELSEY GUAY: I think that being able to see exactly how many can be important.
MS. DUGAN: Because it's 69 and not 80 when duplicates are taken out, does that mean that Charlie Adelson and Donna Adelson don't have a relationship?
KELSEY GUAY: No.
MS. DUGAN: And you still agree that Charlie Adelson is still Donna Adelson's most frequent contact, right? For that time period.
MS. DUGAN: When we looked at Donna Adelson's frequency report in your presentation and in Corbitt's presentation — this one, right?
MS. DUGAN: Number two on that list is not an actual person, right?
KELSEY GUAY: I'd have to pull it up — I don't have it memorized.
MS. DUGAN: Okay. You want to pull yours up?
KELSEY GUAY: Sure.
MS. DUGAN: Okay. Is the second ranking on that list her voicemail — AT&T voicemail routing number?
KELSEY GUAY: Correct.
MS. DUGAN: Okay. So, and then third place on that list of most frequent contacts is Harvey Adelson, her husband, with the 9032 number?
KELSEY GUAY: Correct.
MS. DUGAN: Okay. So Charlie Adelson would still be first, followed by her... the number of calls routed to voicemail.
KELSEY GUAY: Correct.
MS. DUGAN: Um, where did you fly here from?
KELSEY GUAY: Portland, Oregon.
MS. DUGAN: And how long did that take?
KELSEY GUAY: Six-ish hours.
MS. DUGAN: And was that paid for by you or paid for by the defense?
KELSEY GUAY: Paid for by the defense.
MS. DUGAN: And how much are you charging for your work in this case?
KELSEY GUAY: The roll-off charge is $300 an hour.
MS. DUGAN: And does that include the work that you did?
KELSEY GUAY: That we saw here in court.
MS. DUGAN: Prior to coming to court today?
KELSEY GUAY: Correct.
MS. DUGAN: Okay. And does that include your travel?
KELSEY GUAY: Correct.
MS. DUGAN: As far as $300 an hour during the time that you're spent traveling?
KELSEY GUAY: Correct. It's the company's policy.
MS. DUGAN: Okay. And waiting to testify and testifying, is it that same amount?
KELSEY GUAY: Correct.
MS. DUGAN: Do you know the total amount the defense has paid for your testimony here today?
KELSEY GUAY: I don't. The company does.
MS. DUGAN: Do you know about the amount of hours that you spent on this case, including travel?
KELSEY GUAY: The amount of hours on the total case, no.
KELSEY GUAY: On travel, they just do a flat rate of 10 hours if I work over 10 hours. So the trip for the trial would have been about 30 hours, so about $10,000.
MS. DUGAN: Okay. Thank you.
JUDGE EVERETT: Redirect examination?
MR. ZELMAN: Yes, Your Honor. Thank you.
MR. ZELMAN: Ms. Guay, did you prepare a written report that you provided to my office concerning the manual review of Charlie Adelson's phones?
KELSEY GUAY: A report with the frequency analysis for his contact with Donna Adelson.
MR. ZELMAN: Using Donna's records?
KELSEY GUAY: Yes.
MR. ZELMAN: Yes. Okay. And using those records, you indicated that it reflected about 393.
MR. ZELMAN: Would it be helpful to see your report for what your numbers were for unique call events from May 2nd to July 20th? For using Donna's records, did you duplicate between that time period?
KELSEY GUAY: Yes. I think it was 211 deduplicated.
MR. ZELMAN: So 211 rather than 417?
KELSEY GUAY: From May 2nd through July 20th.
MR. ZELMAN: Now, you indicated on cross that — you did not locate — a call between Annie Cunningham and Donna Adelson on July 18th of 2014. Correct?
KELSEY GUAY: I did not see one.
MR. ZELMAN: Okay. Now the records — that are collected — call detail records.
MR. ZELMAN: Those are for communication events that are through the carrier.
KELSEY GUAY: Correct.
MR. ZELMAN: And so any communication event that took place through a third-party app would not be collected there.
KELSEY GUAY: Correct.
MR. ZELMAN: So for example, are you familiar with the apps WhatsApp and Viber?
KELSEY GUAY: Yes.
MR. ZELMAN: Okay.
KELSEY GUAY: So any applications, anything third party — really even FaceTime audio or FaceTime videos — technically not, you know, through the AT&T network. All of that activity would be a data transaction. So when you look at AT&T records for a data transaction, it's not going to show you individual items. For example, that you got an email and that was so many bytes sent on the network — it's just going to show you a time that the data session was open and how many bytes were received and how many bytes were sent from the handset to and from the network. So AT&T does show data transactions, but it's not going to show like a FaceTime audio or, you know, an email.
MR. ZELMAN: So in other words, when you are using FaceTime audio or FaceTime or one of these apps, it's not going to — the number that you dial is not going to show up on the call detail records?
KELSEY GUAY: Correct. It's going to show up on the data session that AT&T records report.
MR. ZELMAN: It would be lumped into the data session?
KELSEY GUAY: You aren't gonna see, like, what was being used for the data session.
MR. ZELMAN: And these data sessions, do they typically have, like, a certain time period that they last?
KELSEY GUAY: A lot of times on an AT&T record you'll see a data session that can run up to about 60 minutes.
KELSEY GUAY: You can have ones that run less than that, but AT&T data is kind of all over the board.
MR. ZELMAN: Now, with these data sessions, the way that our phones work, if you have your phone — constantly having — alerts pushed or emails pushed to your phone.
MR. ZELMAN: Those are going to show up how?
KELSEY GUAY: Again, if it's like, you know, let's say you have your email and you have it set to, like, give me a notification every time I get an email — that means that your phone has to be communicating with Google servers, Gmail servers, right, so that it knows when you get an email. So that's going to be lumped into these data sessions.
MR. ZELMAN: The call detail records that you reviewed for Donna Adelson, specific as to July 18th of 2014 — did those records reflect that Mrs. Adelson's phone was engaged in data sessions?
KELSEY GUAY: On the 18th, it was.
MR. ZELMAN: Was it consistent throughout the evening and night of July 18th, 2014, that Mrs. Adelson's device was engaged in data sessions?
KELSEY GUAY: There were data sessions throughout the day, including the evening.
MR. ZELMAN: So the entire time that she was driving with her husband on July 18th of 2014, her phone was connected to some tower engaged in a data session?
KELSEY GUAY: So the records don't give you, like, minute by minute, second by second. So when I look at data transmissions — data records — I look at the time when that data transmission was initiated, because in order for a data transmission to be initiated, the phone would have to be on and connected to the network. Right, your phone, if it's, you know, in airplane mode or, you know, off, it's not going to be able to reach the network. So the time when that data begins, the phone would have had to be on. When I see these things like 60 minutes, do I know with 100% certainty based on these records that the phone was on for the entire 60 minutes? I can't say that. But I do know at least at the beginning that phone was on and connected to the network. And I did see data transmissions throughout the day and the evening, where the connected time was, you know, kind of throughout the day.
MR. ZELMAN: And so those data sessions — would those be consistent with Donna Adelson having a phone call with Annie Cunningham on either WhatsApp or Viber the night of July 18th of 2014?
KELSEY GUAY: It could be. I can't say if it was or wasn't.
MR. ZELMAN: Just a moment, Your Honor.
MR. ZELMAN: Nothing further, Your Honor.
JUDGE EVERETT: You may step down.
JUDGE EVERETT: What's that?
MS. DUGAN: Would you permit the State to ask one more question?
JUDGE EVERETT: This witness is only here for today under the defense, Your Honor.
MR. ZELMAN: Yes, Your Honor. She flies out this evening.
JUDGE EVERETT: I do not permit recross. Please approach.
JUDGE EVERETT: Based on the witness's limited availability, I will permit the recross on the one question, Ms. Dugan. You may ask.
MS. DUGAN: Defense asked, well, could there be a call to Annie Cunningham on WhatsApp or some app that you're not able to show?
MS. DUGAN: Was Donna Adelson — the afternoon, evening, night of July 18, 2014, was she using her phone to make voice calls and answer voice calls to and from people that night?
MS. DUGAN: Like, when I say voice call, I mean like if I picked up my phone and called your phone, an ordinary voice call — was she using her phone in that manner with other people that night?
KELSEY GUAY: Yes.
MS. DUGAN: Okay. Thank you.
JUDGE EVERETT: Does the defense need to re-redirect on that one point?
MR. ZELMAN: One question, and I'll keep it at one. Ms. Guay — Can you pull up the phone records for Ms. Adelson?
MR. ZELMAN: The night of July 18th of 2014.
KELSEY GUAY: Give me one second.
JUDGE EVERETT: That wasn't the one question, was it?
MR. ZELMAN: No, that was preparatory.
KELSEY GUAY: All right.
MR. ZELMAN: Do you see — Can you tell us how many calls from 8:30 p.m. until 1 a.m. you see in Mrs. Adelson's records. Thank you.
KELSEY GUAY: Three.
MR. ZELMAN: Nothing further.
JUDGE EVERETT: The witness may step down. Thank you.
KELSEY GUAY: Thank you.
JUDGE EVERETT: Is there a brief witness the defense can call before the lunch break?
MR. ZELMAN: Just a moment, Your Honor. We'll see if Ms. Cattleman is back.
JUDGE EVERETT: Thank you.
MR. ZELMAN: Without being able to predict how long the state's cross is going to be of our next two witnesses, I can't say.
MR. ZELMAN: With any degree of certainty how long it will take, I don't know.
JUDGE EVERETT: We'll take our lunch break, then, at this point.
JUDGE EVERETT: Is Ms. Cunningham available?
MR. ZELMAN: She's supposed to be returning from the airport, Judge.
JUDGE EVERETT: Okay. Members of the jury, at this time we will take our lunch break for today. Please do not discuss this case with each other or any other person. Do not seek out any additional information about this matter that has not been discussed in court as well.
JUDGE EVERETT: We will resume with our case at 12:45.
JUDGE EVERETT: Enjoy your lunch break.
JUDGE EVERETT: Please report at 12:45.
JUDGE EVERETT: Everyone can be seated.
JUDGE EVERETT: Please report back by 12:40. We will await the jurors and we will resume with the testimony and the defense's case in chief.
MR. ZELMAN: Thank you, Your Honor.
JUDGE EVERETT: Mr. Zelman, were you able to obtain Ms. Cunningham, or was she able to return?
MR. ZELMAN: May we approach on the scheduling matters?
JUDGE EVERETT: Yes. You can bring in the jurors at this point.
JUDGE EVERETT: Everyone observing in the gallery, please turn the phones off once again.
JUDGE EVERETT: Please be seated. Members of the jury, I hope you had a restful break period. At this time, we are going to continue with the defense's case in chief.