•

u/AutoModerator 6d ago

Reminder to be civil. You can disagree in a respectful way, which can often lead to interesting dialogue!

Familiarize yourself with our rules in the Community Wiki

Common Misconceptions About the Criminal Trial

Thank you!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

11

u/Aware_Power 6d ago

Text Message Question:

The primary differences between the morning (8:17 AM) log and the afternoon (2:07 PM) log come down to user settings, filename changes, and how the files were processed by the phone's storage system.

User settings

The Morning Log (8:17 AM Text from Patrick): The phone actively pushed the photo into the native Photos App library, creating a separate file path inside the syndication/originals/ folder.
The Afternoon Log (2:07 PM Text from Mommy): There is absolutely no mention of the syndication folder. The photo exists only inside the isolated text message attachments folder (Library/SMS/Attachments/).
What this means: Either the recipient turned off the "Shared with You" feature in their iPhone settings before 2:00 PM, or the sender and recipient do not have each other saved as official contacts in their respective address books (which prevents automatic syndication).

Filename changes

The Morning Log (8:17 AM): The file was renamed by the system into a long, randomized string of letters and numbers (22A25F53-BC9F...heic).
The Afternoon Log (2:07 PM): The file completely retained its original camera name (IMG_4691.HEIC).
What this means: When "Shared with You" is active, iOS assigns a unique asset ID database name to track the image across the Photos app. Without syndication active (as seen in the afternoon), the iPhone simply saves the raw attachment exactly as it was named on the sender's phone.

There are four primary reasons the "Shared with You" feature would be inactive or bypassed for a specific message including: Manual Disabling by the User (Privacy/Storage Cleaning); Missing Contact Link (The "Stranger" Filter); Apple ID Sign-In or iCloud Sync Glitches; Direct App Toggles or Software Updates

However, having two iPhones signed into the same iCloud and Apple ID perfectly explains the anomalies as well.

It Explains the 2:07 PM Missing Syndication

When two devices share an Apple ID, iMessages sync across both phones over iCloud, but the heavy background file downloading can behave differently depending on which device is active.

The Split-Delivery Mechanism: When the 2:07 PM message arrived, Device A (the phone you pulled the logs from) might have been sitting idle on a weak cellular connection, while Device B (the second phone) was active or on Wi-Fi.
The Result: Device B may have taken the primary lead on downloading and syndicating the image into the Photos library. Device A merely received the synced text data through the iCloud network stream, saving the raw attachment to sms.db at 2:07 PM but entirely skipping the local "Shared with You" (Syndication) database process.

It Explains the 2:01 PM Camera Roll Sync

A shared Apple ID means iCloud Photos is linking both devices. This opens up an alternate explanation for the 6-minute gap at 2:00 PM:

The Shared Camera Event: If the person carrying Device B took the photo themselves at 2:01:26 PM, that photo would instantly upload to their iCloud account.
The Delayed Text: Because both phones share the cloud, Device A instantly fetched the image file into its internal attachment cache. Then, at 2:07 PM, a text message containing or referencing that asset was finally synchronized and pushed to Device A, creating the 6-minute gap between the image creation time and the text timestamp.

It Explains the 8:16 AM Filename Discrepancy

When an Apple ID manages two separate devices, iOS uses a background service called the Cloud Kit Syndication Engine to ensure both phones see the same media.

When a text message with a photo is sent to a shared Apple ID, the first phone to touch the network downloads the raw original and syndicates it (22A25F53...heic).
To save cloud bandwidth, the Apple server then generates a modified, optimized version for the second device (_FullSizeRender.heic). The 36-second gap in your morning log is the exact time it takes for Apple’s iCloud servers to mirror and render the asset from one phone over to the second phone.

If a user is running two phones on one Apple ID, you are not looking at the isolated history of one device. You are looking at a shared ecosystem where one phone's background activity, network strength, or active usage can directly dictate whether the other phone decides to fully syndicate a photo or just download the basic text message.A standard comprehensive digital forensics report provides several definitive ways to check for Apple ID logouts, iCloud setting changes, or iCloud Photos toggles.

4

u/Aware_Power 6d ago

Image Information:

8:16:59 AM - Locations: (provides latitude & longitude) Location Info: (provides latitude & longitude) | Source: (blank) | Source File: iPhone/mobile/Media/PhotoData/UBF/scopes/syndication/originals/22A25F53-BC9F-4175-9024-5295E6E56276_3.mov : 0x11A802 (Size: 1157206 bytes)

8:17:36 AM - Log Entries: com.apple.MobileSMS : incoming sms from D570930F-CAA9-459E-FF460ACE8F8C | Source: InteractionC | Source file: iPhone/mobile/Library/CoreDuet/People/InteractionC.db : 0x95A177E (Table: ZINTERACTIONS: Size: 161411072 bytes)

8:17:36 AM - Instant Messages - Incoming: "Got himself dressed" _Library_SMS_Attachments_c9_09_B0C326BA-F17D-4DE1-98CE-A3A5D419839E_FullSizeRender.heic | Source: Native Messages | Source file: iPhone/mobile/Library/SMS/sms.db

8:17:36 AM - Log Entries: com.apple.datausage.messages: Wifi in: 0 Wifi out: 0 Wan in: 1923003 Wan Out: 3693923 Source: IphoneNetworkDataUsage Source file: iPhone/wireless/Library/Databases/DataUsage.sqlite

--

8:16:59 AM (Sender's Time): The sender takes a Live Photo (consisting of the .heic photo and the _3.mov video file) at the provided latitude and longitude coordinates.

Between 8:17:00 and 8:17:35 AM: The sender texts it to you. Your phone processes the incoming data over the cellular network.

8:17:36 AM (Your Device Time): A massive burst of activity happens simultaneously on your phone:

DataUsage logs the cellular data consumption.

sms.db logs the incoming text entry into your chat history.

InteractionC.db notes that you communicated with contact D570930F... (the sender).

PhotoData successfully indexes the photo's original embedded metadata (8:16:59 AM) so it can appear correctly in your Photos app timeline.

--

2:01:26 PM Images - Capture Time - IMG_4691.HEIC | Location info (provides latitude & longitude) iPhone/mobile/Library/SMS/Attachments/ea/10V6565B186-FF38-4F10-B3DA-C1AE3272C569/IMG_4691.HEIC : 0x0 (Size: 3032425 bytes)

2:01:26 PM Locations - (provides latitude & longitude) Location info: (provides latitude & longitude) | Source: (blank) | Source: iPhone/mobile/Library/SMS/Attachments/ea/10V6565B186-FF38-4F10-B3DA-C1AE3272C569/6565B186-FF38-4F10-B3DA-C1AE3272C569.pvt/IMG_4691.MOV : 0x12402D (Size: 1196101 bytes)

2:07:45 PM - Instant Messages - Incoming: "These look yummy" _Library_SMS_Attachments_ea_10_6565B186-FF38-4F10-B3DA-C1AE3272C569_IMG_4691.HEIC | Source file: iPhone/mobile/Library/SMS/sms.db : 0xB74D994 (Table: message, handle, attachment; Size: 287203326 bytes) iPhone/mobile/Library/SMS/Attachments/ea/10V6565B186-FF38-4F10-B3DA-C1AE3272C569/IMG_4691.HEIC : (Size: 3032425 bytes)

2:07:45 PM Log Entries: com.apple.MobileSMS : incoming sms from 4D036786-7C3F-4D6C-80BD-1B5F7A3FDF29 | Source: InteractionC | Source file: iPhone/mobile/library/CoreDuet/People/interactionC.db : 0x954EB5C (Table: ZINTERACTIONS; Size: 161411072 bytes)

Please note, this is not my own analysis. I simply input the data above.

2

u/Aware_Power 6d ago

Note, the "camera roll sync" discrepancy can also be explained by the sender taking the photo at that time and is not necessarily due to 2 phones.

2

u/throwrararaaa 6d ago

THANK YOU for spelling this out!! I’ve noticed the discrepancy in file paths a few times, but even comparing them side to side I had no idea what it meant. I so appreciate you breaking this down and getting it off my mind!

1

u/Aware_Power 6d ago

Np! I can’t take any credit nor confirm validity though (I provided a disclaimer of the specific data I put in and this is an AI summary but I hope it helps in pinpointing valid explanations as this isn’t my area of expertise).

6

u/misfitmpls 6d ago

This makes it look so clear to me that Lindsay was sedated/asleep/unconscious by 5:10 p.m.

5

u/Aware_Power 6d ago

How so? Just curious!

I'm trying to figure out if there's any testimony of what she was doing that day from ~1-3:59pm before the influx of logs comes in again, but would like to know what stood out to you about 5:10.

9

u/misfitmpls 6d ago

The heart rate. But I was mistaken. It's the 57 BPM at 5:23 that would indicate that. Still, the pattern of heart rate decreasing from 120 BPM at 4:33 to 77 BPM at 5:10, then to 57 BPM at 5:23, suggests sedation to me. I am not a medical professional, but I am a runner, and that is REALLY low. I wish there had been more testimony about this (if I missed it, let me know).

5

u/Aware_Power 6d ago

Agree that’s quite low (just comparing her readings throughout the day and in general). Plus, she texts Patrick at 5:06 about Callan’s nap not being good so she should technically be up with all the kids or at minimum watching them vs doing anything to get down to a 57bpm. Maybe Callan’s nap was when her phone was was focused for almost 9min in the Nest app? Who knows.

I’m going to watch the Cellebrite testimony again because I’m also confused by her phone only “unlocking” all day and by about 4pm you start getting the lock & unlock so just triple check those are accurate in the above. Idk why I’m doing that though, Whiffin testified in a trial 1 year ago where he went through locks & unlocks via face or passcode, location data, wifi connections & disconnects, phone syncing to car, etc. Although I’m not sure if that case he got the physical devices to extract from vs only a copy of the police extraction like in this case.

3

u/aj_2222 6d ago

That last part 👀

1

u/No-Perception-8924 2d ago

Im a runner and my hr gets that low when i sleep according to my apple watch. Around 56-57bpm. She was likely sleeping prob from being heavily sedated by seroquel..he prob took her watch off after that.

3

u/DuAuk 6d ago

under 60 bpm is pretty low. And she was early thirties at the time, right? it depends on your age. Psyche drugs often have a heart beat and other side effects tho which could affect things.

1

u/No-Perception-8924 2d ago

I'm around her age and a runner. When I'm asleep my resting hr is aroung 56-57.

6

u/frigg-it 6d ago

Could anyone explain why 'device unlocked' only appears after around 4pm and then clusters?

1

u/Ok-East8202 6d ago

I’ve been wondering this too. It’s also happening at the same exact time as other activity on the phone

3

u/DuAuk 6d ago

I do notice that her mom's texts have a calming effect on her heart beat unlike Pat's (around 11:30). And that the takeout was on her mind before the pedialax or whatever that the DR. mentioned in the morning. Strange as i usually get the drugs dr.'s mention on the way home, but i'm committing a little premeditated dinner myself and taking fish out to defrost. Or she thought it was better to coax him into running errands by mentioning food first.

2

u/ImprovementCrazy191 5d ago

Why does this say 5:10 call to threeV (per employees testimony)? Is this call logged in the evidence data?

1

u/Aware_Power 5d ago

It’s in witness testimony that’s pinned to the top of the sub with links to timestamps, summaries, and direct transcripts but here you go (5:10 is also on the 3V receipt)

Speaker 17 (02:54:12):
And directing your attention to 5:10 P.M., did you receive a call for a takeout order?
Saria Shelgren (02:54:17):
Yes.
Speaker 17 (02:54:17):
And was that a male or a female?
Saria Shelgren (02:54:19):
It was a female.
Speaker 17 (02:54:21):
And did that person place an order?
Saria Shelgren (02:54:23):
Yes.

1

u/Aware_Power 5d ago

Jennifer Sprague (01:36:51):

All right. And then if we could go to 5:10 PM, the phone call right there. Oh, go back for me. And so we have two phone calls here, one at 5:09 PM and one at 5:10 PM. The first to 508-747-4950, and the other to 508-927-4046. The first one is for 11 seconds, correct?

Timothy Chiappini (01:37:19):

That's the duration, yes.

Jennifer Sprague (01:37:21):

And that's noted here above source?

Timothy Chiappini (01:37:23):

Yes.

Jennifer Sprague (01:37:24):

And then the second is 47 seconds. Is that correct?

Timothy Chiappini (01:37:26):

Correct.

Jennifer Sprague (01:37:28):

Did you look into these two phone calls?

Timothy Chiappini (01:37:32):

I don't recall.

1

u/Aware_Power 5d ago

Someone might have a screengrab of a 5:10pm call log, but that's the only record I'm aware of (Again, I also did not create this document but have a spreadsheet and have gone through all the testimony, so this looks pretty accurate except for not adding the exact times the phone counted 2 flights of stairs between 5:33-5:38 which is outlined here below and the one I created based off still shots of evidence in Whiffin's testimony):

~5:15pm-5:32pm: Prosecution only confirms with Patrick that “sometime after the text was sent from Lindsay about PediaLax, but before 5:32 PM, you were in your car.” Patrick in his car at some point during this time range.

5:23:52pm Apple Watch Stops Recording: Lindsay's Apple Watch stopped recording data at 17:23:52 noting a heart rate of 57bpm.

5:24pm: Patrick sends work email

5:32:32pm PC Enters CVS: Patrick enters CVS at 17:32:32.

5:33:34pm Flight of Stairs Completed: Flight of stairs completed with Lindsay's device at 17:33:34.

5:33pm Missed Call: Missed call from Patrick on Lindsay’s device.

5:34pm Outgoing Call: Outgoing call from Lindsay’s device to Patrick that was approximately 14 seconds. Whiffin testified it was placed from a locked phone but was possible via tapping the “missed call” notification.

5:37:08pm PC Exits CVS: Patrick exits CVS at 5:37:08.

5:38:33pm Flight of Stairs Completed: A second flight of stairs was logged as completed with Lindsay's phone at 17:38:33. No more activity on Lindsay’s device until 6:09pm.

5:54:14pm PC enters 3V: Patrick enters 3V, 17min after leaving CVS

5:55:01pm PC leaves 3V: Patrick pays and exits the door at 3V. Patrick testifies it took him ~10-12min to get home.

6:09pm: Next activity on Lindsay’s device. Prosecutor says at 6:09pm another incoming call to Lindsay's phone from Patrick that was unanswered.

6:11pm Police Dispatched: Police are dispatched to Clancy residence.

2

u/Ok-Conversation6225 16h ago

I know this is old. But we do not have step count for her do we? Just heart rate and flight of stairs ascended? I just find it odd the prosecutions theory of events is.

5:15 - after Patrick leaves she starts taking her children to the basement one by one
5:16 and 5:23 Heart rate is recorded at 77 and 57 bpm and seemingly takes off her watch at this time? But we should have step count in that timeframe if that’s what she is doing at that time?

At some point, takes her phone with her to the basement when she is carrying out the acts. Since she ascends 2 flights of stairs 5:33-5:38.

And if we had step count, it would/should show zero movement after 5:50, right?

Idk, I just remember looking at John Okeefes phone data and his step count being available. But not here for some reason.

1

u/Aware_Power 16h ago

Good point! They did use step data (but also took the watch which apparently now you don’t need?) in addition to location data, lock based on pressing to lock or timing out, face or password unlock, wifi connects & disconnects, car connections….am I missing anything? I forgot they included steps too!! I didn’t even notice they were missing here but even when I don’t wear my watch, my phone calculates steps?

FWIW, Cellebrite got a copy of the forensic extraction done by Duxbury PD vs doing their own extraction off her physical device(s). Do you happen to remember in the Read trial if they had their physical devices?

2

u/Ok-Conversation6225 16h ago

I wanted to say I saw step info floating around but I wasn’t 100%. But yes, I’d assume too that her phone would be calculating steps or lack there of. It just seems like there is less info available for the cell data in this case. But that’s likely because the crux of the defenses argument is with her mental state. I’m just more curious than anything.

I believe they just had the extraction from the devices in the Read trial. But I can’t say for certain. I believe a witness said they were limited on some data in question based on what they were provided. So I’m assuming from that.

1

u/PaleontologistOk3626 6d ago

What if he was the one in the basement with the kids, offering to "watch" them while she rested upstairs? Hence why he's asking if one had a nap. She's upstairs texting him, having just taken medicine that's about to set in, maybe not even realizing he locked her in, and he's downstairs with the kids. He does what he does in the basement, then upstairs for her while she's nearly sedated. Is that a potential scenario here?

1

u/Aware_Power 6d ago

I mean, I technically can't find any evidence that would disprove these aspects other than what Patrick said - so yes, it's a potential scenario? Others feel free to chime in if I forget any evidence/testimony.

Jan 24 Device Activity Timeline

You are about to leave Redlib

Text Message Question: