An entire trial turned on one question: when was the search run.
A single Google search, a few characters long, sat buried in a phone’s history. Nobody in the courtroom disputed that the search existed. One question ran through both trials, became one of the sharpest fights ahead of the second, and helped fuel a national argument: when.
Karen Read was tried twice over the death of Boston police officer John O’Keefe. Prosecutors argued she struck him with her SUV. The defense argued she was framed. But the argument that set the shape of the trial was not about a vehicle or a scene, it was about a timestamp.
At the centre sat a purely technical question: when exactly was that Google search actually run, and what does the timestamp a forensic tool prints next to it really mean. The defense built a theory on it. The prosecution went after the expert who presented it. After a 2024 mistrial, Read was acquitted in June 2025 of murder, manslaughter and leaving the scene, and convicted of operating under the influence.
Why a timestamp is an interpretation, not a fact
People assume a timestamp is a plain number, the kind of fact nobody argues with. It isn’t. Every such record passes through a chain of decisions before it ever reaches a courtroom:
- Which field was chosen. One record often carries several time fields: created, last accessed, last synced. They are not the same thing.
- Which time zone. UTC versus local time, with or without daylight saving. An hour’s drift moves an event to before or after a phone call. (Daylight saving time trips up forensic examiners twice a year, right on schedule.)
- What the tool did. Extraction software interprets application data structures. Two tools can render the same record differently. (Ask two mapping apps for the fastest route to the same address and you’ll get the idea.)
- Whether the record was recovered from deletion. A recovered entry may have lost some fields, and what survives can mislead more than it explains.
- What else the device was doing. Screen unlocks, app launches, background sync, each changes what “the search happened at” actually means.
None of these is a legal argument. Each one is a testable question hiding inside a single printed number, and every one of them has an answer you can show.
What separates an expert witness opinion that survives cross-examination
This case became a very public lesson in what happens when an expert stakes a strong conclusion on a single artifact, and then has to defend it under oath, in front of a jury. The difference between an opinion that holds and one that comes apart is usually this:
- Document the method, not just the result. Which tool, which version, which settings, against which copy.
- Reproduce it independently. Show the same conclusion from a second tool, or explain why that is not possible.
- State the limits. What the evidence does establish, and explicitly what it does not.
- Test the alternatives. If there is an innocent reading of the same data, the expert should be the first to raise it.
- Protect the original. Hashing, chain of custody, and analysis limited to a working copy.
An expert who does all five keeps the same conclusion after cross-examination. An expert who skipped even one finds out on the stand, in front of everyone. (Debugging live, under oath, is not anyone’s idea of a good demo.)
Why this matters in Israeli courts too
Israel has no case that draws this kind of public attention, but the same evidentiary structure shows up quietly, every week: a WhatsApp record, a system access log, a file timestamp attached to an exhibit. In every one of them, the party filing the evidence is filing its own reading of that evidence, and hoping nobody asks the question Karen Read’s case forced into the open.
This is where a software expert witness earns its place: not to tell the court what happened, but to show what the data supports, what it does not, and with what degree of confidence.
If your case rests on a timestamp
- Preserve the device, not just a screenshot. A screenshot discards every field underneath.
- Ask for the full extraction file. A summary report is somebody’s interpretation; the file is the evidence.
- Run two tools. If they agree, you have durability. If they do not, you found out in time.
- Record the time zone. Of the device, of the system, and of the report. All three can differ.
The case ended in an acquittal, and most of the public remembers the drama of it. Anyone who works with digital evidence should carry away something quieter and more useful: the distance between “the number is right here” and “this is what the number means” is exactly where cases fall apart.
The above is general information and not legal advice. The specific case facts are drawn from the sources listed.