Parsing the Truth: One Byte at a Time

In this episode, Stacy Eldridge and Becky Passmore break down the defense testimony in the State of Tennessee vs. Ahmed Gatlin case and examine what can get lost when you rely on a “movie trailer” version of the evidence instead of the full forensic file. In part six of the series, Stacy and Becky discuss Glenn Buckley’s testimony about the state’s Celebrite timeline report from Gatlin’s iPhone XR. They explore the difference between a reader report and an actual extraction, why forensic examiners should seek the full data, and how SQLite joins, attachment paths, and device artifacts can reveal more than a timeline view.

This is part 6 of a multi-part series.

Support the Podcast by joining the Patreon at https://www.patreon.com/c/ParsingtheTruth

What you’ll learn in this episode:

✔️Why Celebrite Reader can be useful for an initial review but shouldn’t necessarily be treated as the complete source of evidence.

✔️How iPhone text messages and their attachments can be stored in different locations—and why that matters when interpreting the data.

✔️Why a Snapchat image’s origin may be difficult to establish from a report alone, and how to be clear about the limits of the available evidence.

This podcast is for educational purposes only and is based on publicly available information and our knowledge, training, and experience at the time of recording.

In this episode, we unpack a live Snapchat demo, a digital forensics expert, and one critical question: what does a file really prove once it leaves the app?

Stacy Eldridge and Becky Passmore continue their deep-dive coverage of State of Tennessee vs. Ahmed Gatlin as defense expert Glenn Buckley takes the stand and shows how Snapchat data, metadata, and device timestamps can tell very different stories. Buckley walks through how Snapchat stores photos and videos, where those files physically live, and why the answer often depends on what the app saves locally versus what stays on the server. He explains how users choose whether a snap is saved, deleted, shared, or sent outside the app, and why that distinction matters when examiners are trying to recover evidence.

Support the Podcast: https://www.patreon.com/c/ParsingtheTruth

In this episode you’ll learn:

✔️How Snapchat handles camera roll files, saved snaps, and shared media

✔️Why in-app metadata and device timestamps can tell different stories—and may change when files are copied or exported

✔️Why matching the right device and app version matters when examining digital evidence

This podcast is for educational purposes only and is based on publicly available information and our knowledge, training, and experience at the time of recording.

In this episode of Parsing the Truth One Byte at a Time, Stacy Eldridge and Becky Passmore unpack digital evidence and courtroom testimony in the Tennessee v. Ahmed Gatlin trial. They examine how Snapchat files, phone settings, timestamps, Uber location data, Wi-Fi activity, and iPhone records can shape — or complicate — a forensic timeline. The discussion highlights why a file’s location and metadata matter, how device time settings can affect timestamps, and why different digital records may tell different parts of the story. For listeners interested in digital forensics, true crime, or how electronic evidence is challenged in court, this episode offers a plain-language look at the details behind high-stakes testimony.

Three things you will learn from this Episode:

✔️Why Snapchat images or videos may appear in multiple places on a phone, and why that matters when examining a file.

✔️How time-zone and daylight-saving settings can affect the timestamps used to build a digital timeline.

✔️What Uber location updates, Wi-Fi records, and call logs can each indicate — and what they may not prove on their own.

This podcast is for educational purposes only and is based on publicly available information and our knowledge, training, and experience at the time of recording.

This episode explores the cross-examination of a digital forensics expert in the Ahmed Gatlin case, revealing how mobile phone evidence, cloud storage, app permissions, and location data can be interpreted in court. It also offers practical lessons for expert witnesses on preparing for testimony and answering technical questions accurately.

What You'll learn:

✔️Why digital forensic experts should know the legal basis for accessing a device and bring notes or reports to court.

✔️Why gaps in phone activity data don’t, by themselves, prove whether a phone was off, idle, or simply not recording.

✔️How app-specific location permissions differ from phone-wide settings—and why mobile data may be stored on a device, in the cloud, or both.

This podcast is for educational purposes only and is based on publicly available information and our knowledge, training, and experience at the time of recording.

Ahmad Gatlin (16) and 2 other teenagers are on trial for a drive-by shooting. What will significant locations, Uber, and Snapchat data reveal? Listen to the second half of the state's digital forensics examiner's testimony. Everything in this case is leading up to a surprise ending...

This is Part 2 of a multiple-part series.

Support the podcast by becoming a Patreon Member at

⁠⁠https://patreon.com/parsingthetruth⁠⁠

Episode Summary

Stacy Eldridge and Becky Passmore examine digital-forensics testimony from the Tennessee case State of Tennessee vs. Ahmed Gatlin. This episode discusses the second half of the state's digital forensic examiner's testimony. They discuss how investigators interpret phone extractions, photo and video metadata, Snapchat messages, and location data in an attempted-murder investigation. The episode also explores how timestamps can be misunderstood, why the original device matters, and how later handling of a phone may affect the interpretation of evidence.

What You'll Learn:

✔️How Apple Maps and phone-location data can be misinterpreted in court

✔️Why timestamps, call logs, and digital artifacts require careful context

✔️How the presentation of forensic evidence can shape a jury’s understanding

Ahmad Gatlin (16) and 2 other teenagers are on trial for a drive-by shooting. What will significant locations, Uber, and Snapchat data reveal? Tune in and find out in this case that brings a surprise ending.

This is Part 1 of a multiple-part series.

Support the podcast by becoming a Patreon Member at

https://patreon.com/parsingthetruth

Episode Summary

Stacy Eldridge and Becky Passmore examine digital-forensics testimony from the Tennessee case State of Tennessee vs. Ahmed Gatlin. They discuss how investigators interpret phone extractions, photo and video metadata, Snapchat messages, and location data in an attempted-murder investigation. The episode also explores how timestamps can be misunderstood, why the original device matters, and how later handling of a phone may affect the interpretation of evidence.

What You'll Learn:

• How EXIF data and file-system timestamps can differ and why neither should automatically be treated as definitive proof.
• Why Snapchat evidence can be difficult to analyze
• Learn why phone-location evidence should be supported by additional artifacts.

The digital evidence contained no leads until Steve Bunting searched for nothing in the 2021 Keith Gibson murder case.

Special Guest: Steven Bunting

Stacy Eldridge and Becky Passmore talk with digital forensics veteran Steve Bunting about the 2021 Keith Gibson murder case and the breakthrough that came from tracking phone inactivity instead of location data. Bunting explains how iPhone logs, unified logs, and FSEvents exposed a hidden “quiet time” window tied to the Delaware homicide, even when the original reader report showed nothing useful. He also breaks down why Apple location tiles only suggest a general area, why airplane mode is not the same as powering off a phone, and how a simple Python script can reveal patterns across millions of log entries.

What You’ll learn:

• Why “nothing” can be the strongest digital clue
• How power-off gaps show up in iPhone logs
• Why location data can be misleading in court
• How to spot quiet time in noisy forensic data
• Why critical thinking matters more than button-pushing

Download the tool and start finding nothing today

https://buntingdigitalforensics.us/tools/fsevents-gap-finder/

Read More About the Case

https://buntingdigitalforensics.us/insights/the-art-of-hunting-for-nothing/

Books written by Steve Bunting

https://buntingdigitalforensics.us/publications/

Deepfakes are everywhere, and determining the Provenance of digital evidence is more important and challenging than ever before. Lars Daniel joins us to discuss the steps digital forensic examiners can take in their next case.

Special Guest: Lars Daniel

Connect with Lars:

⁠https://www.thelarsdaniel.com/⁠

⁠https://www.linkedin.com/in/larsdaniel/⁠

Support the podcast ⁠⁠⁠https://patreon.com/parsingthetruth⁠⁠⁠

About this Episode

Stacy Eldridge and Becky Passmore talk with Lars about the growing risk of AI generated evidence, why screenshots and consumer device media are increasingly unreliable on their own, and why provenance now has to be treated as a core evidentiary issue.The conversation focuses on how examiners, attorneys, judges, insurers, and law enforcement can respond before fake media becomes routine in litigation and investigations.

Key topics

• In this episode, Lars explains how his work in trucking and accident investigations led him into the deeper problem of AI manipulated media and digital evidence triage.
• He breaks down the practical categories he uses with counsel and claims professionals:
• He describes the business case for a layered review process: automated screening, human review, then a digital forensics expert when litigation is possible.
• The discussion emphasizes that the best way to prove authenticity is still to return to the original device and source evidence whenever possible.
• Lars warns that consumer device evidence often arrives with weak or no provenance, unlike enterprise systems that may have stronger built in controls.
• The hosts and Lars discuss how deep fake claims may become a litigation tactic, forcing the other side to spend time and money disproving authenticity even when the evidence is real.
• He explains the liar’s dividend and why it can be used not just as a defense, but as a strategy to raise costs and create uncertainty.
• A recent civil case example shows how a manipulated video, including added water to suggest a slip and fall, was initially treated as real until deeper analysis raised questions.
• Lars stresses that examiners need to stay in their lane, know when to refer specialized work, and avoid claiming expertise across every digital forensics niche.

Listeners will learn

• How deep fakes, shallow fakes, and enhancement differ
• Why screenshots are no longer enough to trust digital evidence
• How to build a layered authenticity review process
• Why provenance matters in legal and investigative settings
• When to return to the original device for verification

Part 2: We continue the conversation with Jessica Hyde regarding the Daubert Standard, AI, and Peer Reviews.

Special Guest: Jessica Hyde, Hexordia

Support the podcast ⁠https://patreon.com/parsingthetruth⁠

Detailed Summary of Part 2:

In this episode, we explore the critical intersection of digital forensics, legal standards, and artificial intelligence. Jessica Hyde shares her expert insights on the importance of proper testing, validation, peer review, and the evolving standards that govern forensic evidence in court.

Key topics in Part 2:

• The fundamentals of the Daubert standard for admissible scientific evidence

• How digital forensics tools and methodologies meet (or don’t meet) Daubert criteria
• Challenges introduced by AI and machine learning models in forensic analysis
• The critical role of peer review, including internal lab processes and community validation
• The importance of independent testing and error rate assessment for evidence reliability
• Upcoming legislative and regulatory efforts around AI in forensic evidence
• Practical steps for examiners to prepare for Daubert challenges and improve credibility

This episode emphasizes that sound scientific methodology, rigorous peer review, and validation are the backbone of credible digital forensic testimony.

Links:

• The Daubert Standard ⁠https://www.law.cornell.edu/wex/daubert_standard⁠
• Rule 702 ⁠https://www.law.cornell.edu/rules/fre/rule_702⁠
• NIST Foundations document ⁠https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8354.pdf⁠
• NIST OSAC Guidelines for Dataset Development ⁠https://www.nist.gov/system/files/documents/2026/01/16/OSAC-DE-Guidelines%20for%20Dataset%20Development.pdf⁠
• DFIR Review ⁠https://dfir.pubpub.org/⁠
• Upcoming work from SWGDE in this area including the draft Quality Management System ⁠https://www.swgde.org/25-q-001-draft/⁠
• Hexordia Creating Mobile Text Data FREE Online Class ⁠https://learn.hexordia.com/courses/Creating-Mobile-Test-Data-66eae235a2b4ef2d6b79cef3⁠
• Hexordia FREE Mobile Peer Review Checklist ⁠https://www.hexordia.com/blog/gc0vnvj80ogwx724ovu7avzwvjl742?rq=peer%20review⁠
• Rule 707 Regarding AI ⁠https://www.purduegloballawschool.edu/blog/news/ai-generated-materials-federal-rules-evidence ⁠
• Connect with Jessica Hyde on LinkedIn ⁠https://www.linkedin.com/in/hydejessica/⁠
• Connect with Hexordia on Twitter ⁠https://x.com/hexordia⁠

Jessica Hyde joins us to explain what you need to know about Daubert to help you ensure your evidence doesn't get tossed in your next big case. We'll also discuss a new proposed rule of evidence regarding AI.

Special Guest: Jessica Hyde, Hexordia

Support the podcast https://patreon.com/parsingthetruth

Detailed Summary of Part 1:

In this episode, we explore the critical intersection of digital forensics, legal standards, and artificial intelligence. Jessica Hyde shares her expert insights on the importance of proper testing, validation, peer review, and the evolving standards that govern forensic evidence in court.

Key topics:

• The Daubert standard: what it is and why it matters for forensic evidence
• Five Daubert factors: testing, peer review, error rates, standards, and general acceptance
• Challenges of using black box AI tools and generative models in forensic analysis
• Why clicking 'export report' without validation is a legal liability
• The upcoming Federal Rule of Evidence 707 and its impact on AI-generated evidence
• The importance of independent testing, standardization, and peer review in court readiness
• Nightmare scenarios: when evidence fails Daubert criteria, leading to inadmissibility
• The role of certification, experience, and standardization for digital forensic examiners
• How practitioners can proactively prepare for Daubert challenges and legislative changes
• Practical steps for conducting rigorous testing and peer review of forensic artifacts

This episode emphasizes that sound scientific methodology, rigorous peer review, and validation are the backbone of credible digital forensic testimony.

Links:

• The Daubert Standard https://www.law.cornell.edu/wex/daubert_standard
• Rule 702 https://www.law.cornell.edu/rules/fre/rule_702
• NIST Foundations document https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8354.pdf
• NIST OSAC Guidelines for Dataset Development https://www.nist.gov/system/files/documents/2026/01/16/OSAC-DE-Guidelines%20for%20Dataset%20Development.pdf
• DFIR Review https://dfir.pubpub.org/
• Upcoming work from SWGDE in this area including the draft Quality Management System https://www.swgde.org/25-q-001-draft/
• Hexordia Creating Mobile Text Data FREE Online Class https://learn.hexordia.com/courses/Creating-Mobile-Test-Data-66eae235a2b4ef2d6b79cef3
• Hexordia FREE Mobile Peer Review Checklist https://www.hexordia.com/blog/gc0vnvj80ogwx724ovu7avzwvjl742?rq=peer%20review
• Rule 707 Regarding AI https://www.purduegloballawschool.edu/blog/news/ai-generated-materials-federal-rules-evidence
• Connect with Jessica Hyde on LinkedIn https://www.linkedin.com/in/hydejessica/
• Connect with Hexordia on Twitter https://x.com/hexordia