NORFOLK, SS.

SUPERIOR COURT DEPARTMENT

DOCKET NO. 2282CR0117

COMMONWEALTH

vs.
KAREN READ

COMMONWEALTH'S NOTICE OF SCHEDULING REASSEMBLY AND TESTING OF

DEFENDANT'S LEXUS' TELEMATICS SYSTEMS

Now comes the Commonwealth, through its expert, Shanon R. Burgess' in the above-

captioned matter and respectfully provides notice to the defense and this Honorable Court that it

intends to engage in further testing of the defendant's Lexus' telematics system. Mr. Burgess has

opined that significant data was likely not acquired during the chip-off procedure likely caused

by programmer's error. (Programmer is a technical term referring to hardware and software

utilized to acquire and interpret data). 2

The infotainment and telematics modules from the defendant's Lexus were seized

pursuant to a search warrant on February 2, 2022. On November 30, 2023, this court, without

objection from the defendant, allowed the Commonwealth's motion to permit destructive testing

of the infotainment and telematics systems due to the means and methods required to retrieve

this vehicle's data. (Docket Entry No. 173).

On December 1, 2023, the defense expert, Maggie Gaffney performed a procedure

known as a "chip-off', a digital data extraction and analysis technique that involved physically

1 CV of Shanon R. Burgess attached as Exhibit A.

2
See October 10, 2024 letter from Shanon Burges as Exhibit B.
removing memory chips from the Lexus' infotainment and telematics systems. This procedure

was observed by Massachusetts State Police Trooper Nicholas Guarino and the

Commonwealth's expert A.G. Speake, who authored a report detailing the process and his

findings. 3 While a "chip-off' had the potential to be destructive due to the technique required to

remove the chips, in this case the memory chips associated with the infotainment and telematics

modules from the defendant's Lexus were not destroyed and have, along with the infotainment

system, telematics system, and the Lexus vehicle, remained secured in evidence.

Mr. Burgess, through his training and experience, believes the evidence acquired in the

"chip-off' was incomplete and that more data that was not acquired exists on the chips.

Hardware and software updates have developed since December 2023, including but not limited

to an updated version of Berla's iVE software. These updates were not available at the time of

the original testing.

The likely deficiencies from the original testing involve two modules in the vehicle that

have the capability to store data, an infotainment module and a telematics module. The

infotainment module (MMU) includes a built-in diagnostic recorder designed to capture vehicle

operational logs. If a vehicle is equipped with navigation the system can also record

geolocation data in the form of track logs. 4 The telematics module (DCM) also has the

capability to store track logs. Navigation events can be inferred from the start and stop points of

time-based tracking. In addition, the modules may contain device connections to the vehicle

and separately, WIFI connections to the module obtained and stored as the vehicle travels.

3
See Exhibit C.
4
Lexus infotaiment systems first had a native navigation application in 1998
hllp://ma g.Jexus.co. uk/history-of-lexus-navigrl'l ion-systems/
 Mr. Burgess identified that two potential data-bearing components were removed from

the MMU and identified a 64MB flash memory component and a 16MB EEPROM. The prior

readings resulted in three files 8MB in size. Mr. Burgess opines that the acquisition of files in

December 2023 should have been closer to 64MB believing that the discrepancy likely resulted

from deficiencies in the hardware and software used at that time to interpret the data.

Mr. Burgess determined that three potential data-bearing components were removed from

the DCM. Similarly, Mr. Burgess identified that two of the components, Micron JWB57 and

Micron 29F2G08ABAEA likely contained incomplete data acquisition likely resulting from the

hardware and software used at that time. The Micron JWB57 only produced 540MB acquisition

and should have been near 4GB. The Micron 29F2G08ABAEA only netted 264MB and should

have acquired around 2GB.

Based on these likely deficiencies in acquisition Mr. Burgess has recommended a review

of the chips that have previously been removed and subsequently a reattachment of the chips to

the board in the defendant's vehicle. Mr. Burgess would employ updated programming and

current software versions to maximize the chances of a complete acquisition. Mr. Burgess

believes the use of a variety of different hardware programs and updated software will yield a

more fulsome acquisition of data. Mr. Burgess has provided a detailed outline of the procedures

and efforts he would employ. 5

Given that the testing is potentially destructive the Commonwealth is providing formal

notice to the defense and an opportunity for the defense to employ its own expert to be present

during the different stages of further testing. The first stage of testing would occur in Texas and

the subsequent testing procedures would continue in Massachusetts.

5
See Exhibit B.
 The testing is necessary and could produce relevant and material cooborating evidence

for trial. This evidence may be exculpatory or inculpatory. Track logs are essentially an ordered

sequence of GPS coordinate measurements stored by a satellite navigation system. Unlike

telephone satellite data that are employed in triangulation analysis to place a cellphone in a

general area, track logs provide specificity. Generally, track logs are points that are automatically

stored when a device is moving. This information is tantamount to laying down a bread crumb

trail memorializing travel by location and time. The download analysis by Mr. Burgess and use

of other software may also provide information about any other devices connected to the vehicle

(ie. phone) and could potentially identify any Wi-Fi connections that would identify by the

vehicle as it travelled on its route.

In the case at bar track log information is significant. If track log and other various data

information exists it will serve many important functions. The benefit includes corroborating the

defendant's travels before, at the time, and after the defendant's Lexus vehicle was involved in a

triggering event. If track log and Wi-Fi information is retrievable, the data would provide

independent corroboration to the numerous witnesses who made observations that the

defendant's Lexus was parked in front of the Fairview Road address after midnight. Further the

data would identify the location of the defendant's vehicle at the time it engaged in the impact

event and provide the time and location of the defendant's travel from the scene to the location

of Mr. O'Keefe's home.

The Commonwealth provided and introduced at trial video depicting some of the

defendant's travels on January 29, 2022. The additional data, likely to be retrievable would assist

in identifying the precise locations that the defendant's Lexus travelled from the time that the

defendant struck and killed Mr. John O'Keefe until the until the time the vehicle was seized.
 The Commonwealth respectfully requests a hearing within the next fourteen (14) days to

permit prompt testing and production of relevant discovery whereas this matter is scheduled for

jury trial in January 2025.

Respectfully Submitted
For the Commonwealth,

MICHAEL W. MORRISSEY
DISTRICT ATTORNEY

By:
Date: October 11, 2024
Hank Brennan
Special Assistant District Attorney

Adam C. Lally
Assistant District Attorney

IwLOtM.YCll A. lv1 d . ~
Laura A. McLaughlin
Assistant District Attorney
SHANON R. BURGESS OFFICE: 817.251.9910
EMAIL: [email protected]
••••
Digital Forensic Expert

EDUCATION

BGS Bachelor of General Science in Mathematics and Business Administration

University of Alabama - Birmingham, Alabama - Currently Pursuing
MS Associate of Applied Science in Computer Networking
Wallace State Community College - Hanceville, Alabama

PROFESSIONAL CERTIFICATIONS
GASF GIAC Advanced Smartphone Forensics
Analyst Number.: 1247
CCME Cellebrite Certified Mobile Examiner
MCFE Magnet Certified Forensics Examiner
MCCE Magnet Certified Cloud Examiner
CCPA Cellebrite Certified Physical Analyzer
cco Cellebrite Certified Operator
Pl Licensed Private Investigator
State of Texas License No: 00838868
State of Arkansas
CDR Bosch Crash Data Retrieval Technician/Analyst

WORK EXPERIENCE
Mr. Burgess is an expert with nearly a decade of experience in data acquisition, recovery, and forensic investigations.
He leads day-to-day operations and oversees the digital forensic services offered to clients, including data acquisition,
forensic analysis, expert testimony, and forensic consultation.
Mr. Burgess has forensically investigated litigated cases over 9 years, including accident reconstruction, distracted
driving, insurance fraud, criminal investigations, harassment, IP theft, and many other issues involving digital devices.
He is a frequent speaker at industry events, published in professional publications, and constantly sharing insightful
content on topics relating to digital forensics and cybersecurity.
Mr. Burgess regularly conducts research and performs advanced data extraction techniques including forensic chip
swaps, chip-off, in-system programming, JTAG for unsupported and/or damaged devices. He conducts research and
analyzes digital data from iOS, Android, computer, vehicle systems, GPS devices, and other embedded devices
including QNX, VxWorks, and other Real-Time Operating Systems (RTOS).

PRESENTATIONS
"Digital Forensics for Insurance Claims"
NAIIA Annual Conference 2024, San Antonio, Texas, May 2024

"Dive into Supporting eDiscovery with Magnet Forensics Solutions"

549 Silicon Drive, Suite 100 I

.....
Southlake, TX 76092 I 0: 817.251.9910 I aperturellc.com
 aperture
Magnet User Summit 2024, Nashville, Tennessee, April 2024

"Mobile Forensics: Correlating Digital Data Between Mobile Phones, Phone Records, and Vehicle Systems"
Event Data Recorder (EDR) Summit, Houston, Texas, February 2024

"Digital Forensics and Accident Reconstruction"

SATAI Winter Conference, Phoenix, Arizona, January 2024

"Mobile Forensics and Distracted Driving"

State Bar of Texas CLE, Dallas, Texas, November 2023

"Distracted Driving in Accident Reconstruction"

State Bar of Texas Continuing Legal Education (CLE), September 2023

"An Introduction to the Forensic Acquisition of Mobile Devices in Accident Reconstruction"

World Reconstruction Exposition (WREX 2023), Orlando, Florida, April 2023

"Damaged Device Forensics"

Maryland Crash Reconstruction Committee Conference, Linthicum, Maryland, March 2023

"Vehicle System Forensics: Damaged and Unsupported Devices"

Interpol Car Forensics Expert Group, Virtual, December 2022

"Utilizing Digital Forensics and Metadata in Fraud Investigations"

Fort Worth Chapter -Association of Certified Fraud Examiners, Fort Worth, Texas, November 2022

"Utilizing Digital Forensics in Fraud Investigations"

Houston Chapter - Association of Certified Fraud Examiners, Houston, Texas, August 2022

"Heavy Vehicle Event Data Recorders: Data Preservation and Analysis"

TAARS 2019 Conference, Round Rock, Texas, March 2019

"HVEDR Advanced Digital Forensics"

CA2RS 2018 Conference, South Lake Tahoe, California, October 2018

"Forensic Methods for Dealing with Damaged ECM/ECU Components"

EDR 2017 Summit, Houston, Texas, March 2017

WEB!NARS
"Supporting eDiscovery with Magnet Forensics Solutions."
Magnet Forensics and Aperture, May 2024

PUBLICATIONS
"Mobile Forensics: Correlating Digital Data Between Mobile Phones, Phone Records, and Vehicle Systems"
Collision: The International Compendium for Crash Research, 2024

"Forensic Methods for Dealing with Damaged ACM/ECM Components"

Collision: The International Compendium for Crash Research, Vol. 12, Issue 2, 2018

RESEARCH AND TESTING

Mar. 2024 Purpose: Determining forensic acquisition and analysis of Kia infotainment modules.
Performed and participated in chip-off acquisition of Kia infotainment module from a 2022 Kia EV6.
Reverse engineered in-system programming (ISP) connections for Kia module to establish a non-
destructive acquisition technique. Infotainment data from was documented and analyzed.

549 Silicon Drive, Suite 100 I Southlake, TX 76092 I 0: 817.251.9910 I aperturellc.com

 aperture
Jan.2024 Purpose: Validating data recorded by wearable devices in vehicle accidents.
Performed and participated in four high-speed motorcycle-to-sedan impacts utilizing instrumented
vehicles, ATDs, and wearable devices, which included an Apple Watch Series 9, Garmin Vivoactive
5, and Fitbit Charge 6. The impacts included a broadside impact between a Suzuki GSX-R750 and
a moving Honda Civic target, a broadside impact between a Yamaha YZF-R1 and a moving Honda
Civic target, a broadside impact between a Kawasaki Versys 650 and a moving Honda Civic target,
and an angled frontal impact between a Kawasaki Versys 650 and a stationary Honda Civic target.
Vehicle dynamics, EDR data, and wearable data were documented and analyzed.
•Results presented at SATAI Conference, January 2024, Glendale, AZ

Nov. 2023 Purpose: Correlating data from mobile devices, call detail records, and vehicle systems.
Performed and participated in ten low-speed sedan-to-pedestrian impacts utilizing instrumented
vehicles, ATDs, and mobile devices, which included an Apple iPhone 15 Pro Max, Samsung A51,
and Google Pixel. The call detail records included carriers AT&T and T-Mobile. The impacts included
near impacts between a Chevrolet Equinox and a moving pedestrian target. EDR data including FCM
data, mobile device data, and call detail records were documented and analyzed.
•Results presented at EDR User's Summit, February 2024, Houston, TX

Nov. 2023 Purpose: Determining forensic acquisition and analysis of Samsara camera modules.
Performed and participated in chip-off acquisition of Samsara camera module specifically a Samsara
CM32 camera module. Reverse engineered in-system programming (ISP) connections to establish
a non-destructive acquisition technique. Internal logs and proprietary .sm video files were
documented and analyzed. Proprietary .sm video files were successfully converted into .mp4 video
files.

Aug.2023 Purpose: Determining forensic acquisition and analysis of Lytx camera modules.
Performed and participated in chip-off acquisition of Lytx camera module specifically Lytx DC and SF
camera modules. Reverse engineered in-system programming (ISP) connections to establish a non-
destructive acquisition technique. lntemal logs a;;d pmpristary. dee vld&o files ;,vere documented and
analyzed. Proprietary. dee video files were successfully converted into .mp4 video files.

Nov.2021 Purpose: Determining forensic acquisition and analysis of Hyundai infotainment modules.
Performed and participated in chip-off acquisition of Hyundai infotainment module from a 2020
Hyundai Sonata. Infotainment data was documented and analyzed.
*Results presented at Interpol Car Forensics Expert Group, December 2022, Virtual

2016 - Present Purpose: Determining chip-swap acquisitions of various damaged devices.

Performed and participated in novel chip-swap acquisitions of various damaged devices including
airbag control modules (ACM), engine control modules (ECM), and mobile devices. Devices were
subjected to various forms of damage including thermal, water, and impact-related damage. Proof of
concepts were performed on various devices to determine data-bearing components. Processes and
data were documented and analyzed. Continuously performing chip-swap acquisitions of new
devices and modules.
*Results first presented at EDR User's Summit, 2017, Houston, TX.

CONTINUING EDUCATION AND TRAINING - DIGITAL FORENSICS

Apr. 2024 Magnet User Summit - Nashville, TN
Topics Included: Synthetic Al Media Detection, Insider Threat Investigations, Building Digital
Forensic Labs, Secure Cloud Operations, Building and executing automated workflows, Triaging
endpoints, Incident Response Playbooks, Ransomware Playbooks, Acquiring, monitoring, and
analyzing live logs from iOS devices via USB protocol, iOS Shortcuts in Mobile Investigations,
Understanding and Mitigating Advanced Ransomware Attacks, Drone Forensics
•Personally presented on Mobile Forensics and eOiscovery.

Feb.2024 Event Data Recorder (EDR) User's Summit- Houston, TX

Topics Included: GM Vehicle Systems, Forward Camera Module (FCM) Data, Toyota Safety Sense
Testing and Research, Heavy Vehicle EDR, Automated Traffic Signals, Toyota Vehicle Control

549 Silicon Drive, Suite 100 I Southlake, TX 76092 I 0: 817.251.9910 I aperturellc.com

 aperture
History, EDR Data Verification, Hyundai and Kia Systems, Vehicle System Forensics, and Tesla Can
Bus Data
*Personally presented on Mobile Forensics, Call Detail Records, and Vehicle System Data.

Jan.2024 Southwestern Association of Technical Accident Investigators (SATAI) - Glendale, AZ

Topics Included: 3D Technologies for Crash Scene Documentation, Motorcycle reconstruction
Topics, The Biomechanics of Motorcycle Helmets, and Crash Test Data Review.
*Personally presented on Mobile and Wearable Forensics.

Jul. 2023 Wireless Fundamentals - Terracom Training Institute - Dallas, TX

Topics Included: Radio, Wireless Spectrum and Radio Bands, Analog Radio, Digital Radio, and
Propagation, Penetration, and Fading

Jul. 2023 Mobile Communications - Terra com Training Institute - Dallas, TX

Topics Included: Mobile Network Components and Operation, Cellular, Mobile Internet, Mobile
Network Operators, Global System for Mobile Communication (GSM), and Code-Division Multiple
Access (CDMA), and loT Communications.

Jul. 2023 Fixed Wireless - Terracom Training Institute - Dallas, TX

Topics Included: Infrared, Bluetooth, Wi-Fi, Point-to-Point Microwave, Broadband Wireless Internet,
Low-Power Wide Area, and Satellite.

May. 2023 Digital Video Examinations - Magnet Forensics - Dallas, TX

Topics Included: Digital Video Recorder (DVR) collection and Best Practices, DVR Examiner, Frames
and Rates, Resolution, Aspect Ratio, Metadata, File Formats, Multimedia Containers and
Extensions, Macroblocks, Codecs, Compression, and Color Sampling.

Apr. 2023 World Reconstruction Exposition (WREX) 2023 - Orlando, FL

Topics Included: ADAS and Advanced Safety Systems, Automotive Test Equipment, Distracted
Driving Investigations, EDR Accuracy, Infotainment Forensics, Chip-Swap Forensics, GPS
Forensics, Toyota VCH Data, Video Analysis and Forensics.
*Personally presented on Mobile Forensics in Accident Reconstruction.

Mar. 2023 Maryland Crash Reconstruction Committee (MCRC) Symposium - Linthicum Heights, MD
Topics Included: Automated Driving Systems, and Advanced Driver Assistance Systems
*Personally presented on Damaged Device Forensics.

Dec. 2022 Interpol 4th Annual Car Forensics Expert Group - Interpol - Virtual Worldwide
Topics Included: Vehicle System Forensics.
*Personally presented on Vehicle System Forensics - Damaged and Unsupported Devices.

Aug. 2022 SANS DFIR Summit- SANS Institute - Dallas, TX

Topics Included: Pattern of Life- Health and Location Data, Digital Forensics Acquisitions, Log Files,
Android Malware, USB Device Serial Numbers, Windows Remote Access, Data Security, Threat
Hunting Workflow, Active Directory Persistence, OSINT Forensics, Zero Trust Environments,
Incident Response, and Google Workspace.

Jul. 2022 Driver Distraction from Electronic Devices - Society of Automotive Engineers - Dallas, TX
Topics Included: Driver Distraction Research, Cognitive, Auditory, Visual, and Manual Forms of
Distraction, Policy Efforts, Effective Strategies, Techniques and Technologies for minimizing
distracted driving.

Jun.2022 Smartphone Forensic Analysis In-Depth - SANS Institute - Orlando, FL

Topics Included: Malware and Spyware, Android Analysis, iOS Analysis, Backup File Analysis,
Evidence Destruction Analysis, Third-Party Application Analysis, Parsing Application Databases, and
Browser Analysis.

Mar. 2022 Magnet Forensics Virtual Summit 2022 - Magnet Forensics - Dallas, TX

549 Silicon Drive, Suite 100 I Southlake, TX 76092 I 0: 817.251.9910 I aperturellc.com

 aperture
Topics Included: Android Binary XML, Blockchain Cryptocurrency, Cloud Forensics, Cybersecurity
Frameworks, OSINT Automation, Linux Acquisitions, loT Forensics, Detection and Mitigation of Anti-
Forensics.

Aug.2021 SANS DFIR Summit- SANS Institute - Dallas, TX

Topics Included: Google Workspace Incident Response, Blockchain, Investigation Techniques, Log
Forensics, Smartphone Forensics, Validating Evidence, Business Email Compromise, and Facebook
Portal Forensics.

Aug. 2021 Advanced Computer Forensics - Magnet Forensics - Dallas, TX

Topics Included: EMO and Volume Serial Numbers, Missing Files and Folders, Prefetch Files,
Jumplists and Most recently Used (MRU), RAM collection and analysis, Windows Encryption, Google
Drive, Windows File History, and File System Logging.

Jul. 2021 Incident Response Examinations - Magnet Forensics - Dallas, TX

Topics Included: MITRE Attack, NIST Controls, Malware, Packet Captures (PCAP), RAM Analysis,
Static Analysis, Dynamic Analysis, Pattern Matching and Searching with YARA, and Log Files.

Jun.2021 Cel/ebrite Certified Physical Analyst- Cel/ebrite - Dallas, TX

Topics Included: Digital Forensic Examinations, Comprehensive Reporting, Data Verification and
Validation, Chain of Custody, Smartphone Identification, Android and iOS Operating Systems and
File Structures, Data Carving Techniques, SQLite Databases, Flash Memory Characteristics, Byte-
Level Data Searches.

Jun.2021 Cel/ebrite Certified Operator- Cellebrite - Dallas, TX

Topics Included: Pre-extraction considerations, UFED configurations, On-scene identification, Digital
Evidence Best Practices, Cellphone Extractions, and Supported Data Extractions and Limitations.

Ma;. 2021 ,'11agnat Forensics Virtual Sumn;it 2021 - ,\1agnat Forensics- Dallas_. TX
Topics Included: Android Binary XML, Blockchain Cryptocurrency, Cloud Forensics, Cybersecurity
Frameworks, OSINT Automation, Linux Acquisitions, loT Forensics, Detection and Mitigation of Anti-
Forensics.

Mar. 2021 Forensic Fundamentals - Magnet Forensics - Dallas, TX

Topics Included: Preservation and Collection of Digital Evidence, Drive Geometry, Data Storage
Concepts, Partitioning, Formatting, and File Systems, Boot Process, Principles of Data Storage,
Windows Registry, Imaging Computer Media, and Mobile Devices.

Oct. 2020 Advanced Mobile Forensics - Magnet Forensics - Dallas, TX

Topics Included: iOS System Artifacts, Pattern of Life Analysis, iOS Application Analysis, Social
Media and Messaging on iOS, Android System Artifacts, Android Application Analysis, Social Media
and Messaging on Android.

Sep.2020 Internet and Cloud Investigations - Magnet Forensics - Dallas, TX

Topics Included: Cloud Investigations, OSINT Investigations, Apple, Google, Microsoft, Twitter,
Facebook, lnstagram, Dropbox, Box, and Email.

Sep.2020 Advanced iOS Examinations - Magnet Forensics - Dallas, TX

Topics Included: Understanding iOS and Apple Security, Device Image Types and File System
Acquisitions, and iOS Artifacts.

Sep.2020 Magnet AXIOM Examinations - Magnet Forensics - Dallas, TX

Topics Included: Evidence Processing and Reporting, Operating System Artifacts, Encryption, Anti-
Forensics, Web Related, Communications, Documents, Media, and Cloud.

Aug.2020 Computer Hacking Forensic Investigator- EC-Council- Dallas, TX

Topics Included: Investigation Processes, Understanding Hard Disks and File Systems, Data
Acquisition, Anti-Forensics Techniques, Windows Forensics, Linux and Mac Forensics, Network
Forensics, Malware Forensics, Cloud Forensics, Email and Social Media Forensics, Mobile
Forensics, and loT Forensics.

549 Silicon Drive, Suite 100 I Southlake, TX 76092 I 0: 817.251.9910 I aperturellc.com

 aperture
Sep.2019 Video Examinations for the Police Investigator - Input Ace - Murfreesboro, TN
Topics Included: Video Analyzing and Best Practices, Input Ace, Frames and Rates, Resolution,
Aspect Ratio, Metadata, File Formats, Multimedia Containers and Extensions, Macroblocks, Codecs,
Compression , and Color Sampling.

Jun.2018 CyberTruck Challenge - Warren, Ml

Topics Included : CAN Bus, Heavy Vehicle Engines, Heavy Vehicle Software, Truck Systems,
Hardware, Cryptography, Conducting Assessments, and Side Channel Analysis.

Sep.2017 BGA Operational/Rework and Chip-Off- Precision PCB Services Inc. - Oroville, CA
Topics Included: Managing BGA Implementation, Component Considerations, Printed Boards and
Mounting Structures, Printed Circuit Assembly Design Consideration, Assembly of BGAs on Printed
Circuit Boards, Reliability, Defect and Failure Analysis.

CONTINUING EDUCATION AND TRAINING -ACCIDENT RECONSTRUCTION

Drivers' Responses to Path Intrusions, Crash Safety Solutions, Dallas, TX, 2022
Aerial Photogrammetry for Crash Investigation using Pix4D, Hattiesburg, MS, 2019
EDR Summit 2019, Houston, Texas, 2019
Heavy Truck Crash Reconstruction, Byron Center, Ml, 2018
Pedestrian and Bicycle Crash Investigation, Pelham, AL, 2017
Using Microsoft Excel for Traffic Crash Reconstruction, Pelham, AL, 2017
EDR Summit 2017, Houston, Texas, 2017
Bosch Crash Data Retrieval Analyst, Rusty Haight, Pelham, AL, 2017
Commercial Vehicle Crash Investigation, Institute of Police Technology and Management, Scottsdale, AZ, 2016
Bosch Crash Data Retrieval Technician, Level 1 and Level 2, Pelham, AL, 2016
World Reconstruction Exposition (WREX 2016), Orlando, FL, May 2016
Motor Vehicle Accident Reconstruction and Cause Analysis, Dr. Rudy Limper!, Pelham, AL, 2016
Crash and Crime Scene Photography, Pelham, AL, 2015

549 Silicon Drive, Suite 100 I Southlake, TX 76092 I 0: 817.251.9910 I aperturellc.com

EXHIBIT B
• • •• • •
-·~·-
•
aperture
TRUTH IN FOCUS.

October 10, 2024

Detective Lieutenant Brian Tully

The Commonwealth of Massachusetts Department of State Police
Division of Investigative Services
Norfolk State Police Detective Unit
45 Shawmut Road
Canton, MA 02021

Re: Commonwealth of Massachusetts v. Karen Read - Infotainment Data

Acquisition Protocol

A protocol for infotainment data acquisition is below.

Based on the information provided, the subject vehicle is a 2021 Lexus LX570 with VIN
JTJFY7AX1M4343547. Currently, there are two known and documented modules within
the vehicle that have the capability to store data.

The infotainment module, identified as a multimedia unit (MMU), includes a built-in

diagnostic recorder designed to capture vehicle operational logs. This system can store
data related to connected devices and vehicle events, such as ignition status, device
connections, and Wi-Fi connectivity. If the vehicle is equipped with navigation, the
system is also capable of recording geolocation data in the form of track logs. MMU
system modules are produced by various manufacturers, including Fujitsu Ten/Denso
Ten, Pioneer, and Panasonic.

The telematics module, known as a data communications module (DCM) and previously
referred to as Toyota TL-19, has the capability to store data such as track logs and the
vehicle's VIN. In addition, navigation events can be inferred from the start and stop
points of time-based tracking. DCM system modules are manufactured by LG
Electronics, and the model number on the label must start with TL 19. However, a TL 19
module is not installed in every vehicle.

On December 1, 2023, chip-off acquisitions were performed on the following removed

modules.

Infotainment Module
The infotainment module, Toyota part number 86130-60M54, was manufactured by
Pioneer and has a serial number of TKPK000408US. This module aligns with the
previously described multimedia unit (MMU).

ARIZONA I CALIFORNIA I COLORADO I NEVADA I TEXAS aperture!lc.corn

Commonwealth v. Karen Read October 10, 2024

Two potential data-bearing components were removed and identified: a Spansion

S99JL064J001 64MB flash memory component in a TSOP48 package format, and a
Macronix 16MB EEPROM in a SOIC8 package format.

The Spansion component was read three times using UP-828 programmer software
version 1.1.8.52, employing the default algorithm for an S29GL064A 10TAIR3
component. The resulting acquisitions were saved as .bin files, each approximately
8MB in size. However, the component has a storage capacity of 64MB, indicating that
the acquisition files should be closer to 64MB. This discrepancy likely resulted from the
programmer's inability to fully read the component, leading to incomplete data
acquisition.

Telematics Module
The telematics transceiver module, identified as Toyota 86740-60320 and manufactured
by Denso Corporation, does not align with the previously described data
communications module (DCM).

Three potential data-bearing components were removed and identified as follows: a

Micron JWB57 - MT29C4G48MAAGBBAKS-48 IT 4GB NANO memory component in a
137-ball eMCP package format, a Micron 29F2G08ABAEA 2GB NANO memory
component in a TSOP48 package format, and a Spansion FL 116KBF4 16MB EEPROM
component in a SOIC8 package format.

The Micron JWB57 component was read using UP-828 programmer software version
2.0.3.1, with the default algorithm for an i\tlT29C4G48fVIAAGBBAKS component. The
resulting acquisition was saved as a .bin file, approximately 540MB in size. Since the
component has a storage capacity of 4GB, the acquisition file should be around 4GB.
This discrepancy likely occurred because the programmer was unable to fully read the
component, resulting in an incomplete data acquisition.

The Micron 29F2G08ABAEA component was read using UP-828 programmer software
version 1.1.8.52, with the default algorithm for an MT29F2G08ABAEAWP component.
The resulting acquisition was saved as a .bin file, approximately 264MB in size. Given
that the component has a storage capacity of 2GB, the acquisition file should be around
2GB. The discrepancy is most likely due to the programmer's inability to fully read the
component, resulting in an incomplete data acquisition.

Based on the information above, I recommend proceeding with the following protocol.

1. Re-Attempt Chip-Off Acquisition

a. Before re-soldering the components back onto the modules, perform
additional chip-off acquisition attempts to ensure complete data capture.
b. Steps:
i. Inspect the memory components and ensure they are clean and
free from contaminants.
ii. Verify that the programmer is correctly configured with the
appropriate algorithm for the component.
iii. Try using different programmer devices or updated software
versions to maximize the chances of a complete acquisition.

ARIZONA I CALIFORNIA I COLORADO I NEVADA I TEXAS ap&rturellc.corn

Commonwealth v. Karen Read October 10, 2024

iv. If available, use alternative algorithms that may better suit the
specific memory type.
v. Perform multiple acquisition attempts, if needed, to achieve a
consistent file size matching the expected capacity.
vi. Document the acquisition details, including programmer settings,
software versions, and any troubleshooting steps taken.
vii. Create forensic hash of acquisitions.
2. Re-Soldering and Re-Installation
a. Upon successful completion of chip-off acquisitions, re-solder the memory
components onto their respective modules.
b. Reinstall both modules into the vehicle, ensuring all connections are
secure.
3. In-Vehicle Acquisition Using Berla iVe Software
a. After the modules are reinstalled, perform an in-vehicle acquisition of the
Multimedia Unit (MMU) using Berla iVe software to capture any data that
may not have been accessible through the chip-off process.
b. As of December 1, 2023, the in-vehicle acquisition method for the MMU
using Berla iVe was not available and/or supported.
4. Manual Documentation of Vehicle Data
a. If the vehicle can be powered on, manually document any on-screen data,
including hardware/software information, date/time settings, and other
relevant information.
5. Power Down Vehicle
a. Remove any power supplies and ensure the vehicle is completely
powered down.

Shanon Burgess

~ : e,,..'tir~

ARIZONA I CALIFORNIA I COLORADO I NEVADA I TEXAS 0rrnrturellccom

 e
ueh1cleqens1cs

Summary

My services were requested by Detective N. Guarino of the Massachusetts State Police.

The request was for observation of an infotainment and telematics module chip off from
a defense expert on a case he was involved in. In addition, I was asked to review data
from the extractions and determine if there were any Global Positioning System (GPS)
data points located in the raw data.
On December 1, 2023, at approximately 0900 hours I arrived at the Foxboro Barracks
for the Massachusetts State Police. The address was 136 Washington Street, Foxboro,
MA. I met with Detective Guarino as well as other personnel associated with the case.
I met with the defense expert witness, Mrs. Maggie Gaffney from Teel Technologies. It
was decided prior to my involvement in this case that Mrs. Gaffney was going to remove
the memory chips from the infotainment system and telematics system.
The vehicle was a 2021 Lexus LX570 with a VIN of JTJFY7AX1M4343547. I
photographed the vehicle as well as interior locations where the infotainment and
telematics system had been. Both modules were removed as part of the initial case and
had been done so prior to my arrival.
Devices

At approximately 1045 hours prosecution and defense experts convened in the

conference room at the Norfolk District Attorney's Office, 45 Shawmut Road in Canton,
MA. At approximately 1100 hours, Mrs. Gaffney, Detective Guarino and I moved to the
forensics lab in a separate part of the building, along with the infotainment and
telematics modules.
During the entire forensic process, I found that Mrs. Gaffney's techniques and methods
of handling, removing memory chips from the printed circuit board (PCB) and reading
the data with specialized equipment were all done in accordance with forensically sound
practices and procedures. Equipment utilized was from Detective Guarino's forensic lab
as well as items brought in by Mrs. Gaffney. Detective Guarino's lab is set up with the
proper equipment for this type of data extraction as he also has the training and
experience for the scope of work that was performed.
The data extractions that were pulled from the memory chips were provided to Detective
Guarino and I by Mrs. Gaffney. The image files were confirmed to be the same as
downloaded by comparing the MD5 hash values of each extraction.
The first module that was worked on was the main Infotainment head unit. This unit
was manufactured for Toyota by the Pioneer Corporation. The model number was
NXF-4758 with a serial number of TKPK000408US.

N~F-4758:rro'X
, , n . v :-::. •a tt•!!.SJ
,w.t. !It /~!QJ£11Cl- ~• • a:ld S\tt • l 1lo C..,
111 17,75"" I l4 I t'!I:

t°s1'1!!: }~~t1~t-:'~f-~u;~i~~::,,,I~-:0.'~J::fl ~e~-a:!!l t~~~:!foa

11ropr fp'twy tnlf1111U1rh at j! l q1JJ!Y Clflh•I CDr11

~H IO cool K9LJ 4QH0 I US 1

SlRll'HQ./HO ~ Sa!IE TKPK000408U S

Once the case was opened, Mrs. Gaffney located several chips of interest on the board.
The first one from the Infotainment module was a Spansion S99JL064J001 TSOP chip.
A read of the Spansion S99JL064J001 was done utilizing an UP828P system with a
TSOP48 adapter. There was no exact matching profile for this particular chip, however
there were three similar profiles. All three profiles were used and data extracted from
the chip were the same in all three instances. See below for specifics of the download
for all three instances:
Welcome to UP-828 Ultra Programmer
Software Version: 1.1.8.52, Updated Date:8/30/2022
Selected device: [SPANSION] S29GL064A10TAIR3 @TSOP48 #TSOP48R
This device default program algorithm is "NOR_Normal"
Connecting to a programmer.
The programmer site #1 has been connected to the USS port #1
Selecting device
Selected device: [SPANSION] S29GL064A11TAIR3 @TSOP48 #TSOP48R
This device default program algorithm is NOR_Normal
Reconnecting to the programmer.
The programmer site #1 has been connected to the USB port #1
Creating the buffer.
Creat completed. Default data is FFh. Elapsed time 0.20s
Calculating the buffer checksum.
Buffer Checksum: 7F80FF00 (CheckSum32)
Calculate completed. Elapsed time 0.06s
Start read device
Detected the current adapter, TSOP48, match the adapter of current device.
Reading NOR.
Read success. Elapsed time 1.67s
Verifying NOR.
Verify success. Elapsed time 1.38s
Read device completed. Elapsed time 4.70s
Calculating the buffer checksum.
Buffer Checksum: 528D565D (CheckSum32)
 Calculate completed. Elapsed time 0.06s
Save the file, C:\Users\Maggie Gaffney\Desktop\Chip Read - KR Case\lnfotainment
TSOP48\Read 1 - S29GL064A11TAIR3.bin
Save completed. Elapsed time 0.19s
Selecting device
Selected device: [SPANSION] S29GL064A 11 TFIR4 @TSOP48 #TSOP48R
This device default program algorithm is NOR_Normal
Reconnecting to the programmer.
The programmer site #1 has been connected to the USB port #1
Creating the buffer.
Great completed. Default data is FFh. Elapsed time 0.20s
Calculating the buffer checksum.
Buffer Checksum: 7F80FF00 (CheckSum32)
Calculate completed. Elapsed time 0.06s
Start read device
Detected the current adapter, TSOP48, match the adapter of current device.
Reading NOR.
Read success. Elapsed time 1.67s
Verifying NOR.
Verify success. Elapsed time 1.34s
Read device completed. Elapsed time 4.66s
Calculating the buffer checksum.
Buffer Checksum: 528D565D (CheckSum32)
Calculate completed. Elapsed time 0.08s
Save project, C:\Users\Maggie Gaffney\Desktop\Chip Read - KR Case\lnfotainment
TSOP48\Read2 - TSOP48 S29GL064A11TFIR4\Read2 - TSOP48
S29GL064A 11 TFIR4.upproj
Calculating the buffer checksum.
Buffer Checksum: 528O565D (CheckSum32)
 Calculate completed. Elapsed time 0.06s
Save the data file.

Calculating the data file checksum.

Data file checksum: 19761EA3E108FD8591B76E558ECC19E4 (MOS)
Calculate completed. Elapsed time 0.08s
Save completed. Elapsed time 0.59s
Selecting device

Selected device: [SPANSION] S29JL064H70TAI00 @TSOP48 #TSOP48R

This device default program algorithm is NOR_Normal
Reconnecting to the programmer.
The programmer site #1 has been connected to the USB port #1
Creating the buffer.
Great completed. Default data is FFh. Elapsed time 0.19s
Calculating the buffer checksum.
Buffer Checksum: 7FB0FFOO (CheckSum32)
Calculate completed. Elapsed time 0.08s
Start read device

Detected the current adapter, TSOP48, match the adapter of current device.
Reading NOR.
Read success. Elapsed time 1.84s
Verifying NOR.
Verify success. Elapsed time 1.55s
Read device completed. Elapsed time 5.03s
Calculating the buffer checksum.
Buffer Checksum: 528D565D (CheckSum32)
Calculate completed. Elapsed time 0.08s
Save project, C:\Users\Maggie Gaffney\Desktop\Chip Read - KR Case\lnfotainment
TSOP48\Read 3\Read 3.upproj
Calculating the buffer checksum.
 Buffer Checksum: 52805650 (CheckSum32)
Calculate completed. Elapsed time 0.06s
Save the data file.
Calculating the data file checksum.
Data file checksum: 19761EA3E108FD8591B76E558ECC19E4 (MOS)
Calculate completed. Elapsed time 0.08s
>>Save completed. Elapsed time 0.61s
MD5: 19761ea3e108fd8591b76e558ecc19e4

The second chip from the Infotainment module was a Macronix 25L 1606E

The Macron ix 25L 1606E was removed from the PCB, however it was not read at the
time of the extraction as it was determined to be a serial flash chip designed for
programming and not user data storage.
The second module that was worked on was manufactured for Toyota by Denso. The
model number was 86740-60320 with an IMEI number of 357844064276843.

Once the case was opened, Mrs. Gaffney located several chips of interest on the board .
The first one was a Micron JWB57 BGA 137 chip.

A read of the Micron JWB57 was done utilizing an UP828P system with a FBGA 137P
adapter. See below for specifics of the download for this chip:
Welcome to UP-828P Ultra Programmer. (12/1/2023 12:53:55 PM)
Software Version: 2.0.3.1, Updated Date: 8/22/2023
Load database.
Selected device, NANO [ACSIP] NCPPS4N2A @BGA162-0.50 #VBGA162NP
 Default Algo, NAND_Skip
Please according to the program requirements, re-select a device, select the
algorithm, open the data file, set the algorithm, auto-program or start mass production
or save project or save image file ...
Connect the programmer.
Demo
Detected the programmer site #1, it's UP-828P#P
Disconnect the programmer site #1. (12/1/2023 12:55:05 PM)
Demo (12/1/2023 12:55:05 PM)
Detected the programmer site #1, it's UP-828P#P
Selecting device. (12/1/2023 12:55:52 PM)
Selected device, NANO [Micron] (JWB57 _4K+224)MT29C4G48MAAGBBAKS
@FBGA137 #FBGA137P
Default Algo, NAND_Skip
Creating buffer. (12/1/2023 12:57:26 PM)
Great buffer success. Elapsed time 0.90s.
Reconnect the Programmer after selected device.
Detected the programmer site #1, it's UP-828P#P
Opened window [NAND_Skip - Ready to read] ... (12/1/2023 12:57:33 PM)
Closed window [NAND_Skip - Ready to read] by press [Ok] button. (12/1/2023
12:57:36 PM)
Read device data into buffer. (12/1/2023 12:57:36 PM)
Site #1: Already placed device. (12/1/2023 12:57:38 PM)
Site #1: Check device ID.
Site #1: Device ID correct, MID=2Ch, DID=ACh.
Site #1: Clear buffer for empty. (12/1/2023 12:57:39 PM)
Site #1: Alreay cleared buffer to FFh. Elapsed time 0.90s.
Site #1: Check device bad block.
Site #1: This device has no bad block.
Site #1: Check bad block completed. Elapsed time 1.54s.
 Site #1: Reading the device, skip bad block.
Site #1: Read device success. Elapsed time 42.24s.
Site #1: Verifying the device.
Site #1: Verify device success. Elapsed time 45.57s.
Site #1: Read device completed. Total elapsed time 90.24s. (12/1/2023 12:59:09
PM)
Calculating buffer checksum (CheckSum32) ... (12/1/2023 12:59:11 PM)
CEO: 4O4E7E74
Calculated the buffer checksum success. Elapsed time 1 .66s.
Saving buffer to data file... (12/1/2023 12:59:34 PM)
Saved to: C:\Users\Norfo\Desktop\AG\Telamtics Module\JWB57\
Saved buffer: USER
Save success. Elapsed time 0.26s.
MD5: 9cc868a4e83dabd8c5db349188920c86

The second chip from the Telematics module was a Micron 29F2G08ABAEA TSOP
chip .

• • • • •

A read of the Micron 29F2G08ABAEA was done utilizing an UP828 system with a
TSOP 48 adapter. See below for specifics of the download for this chip:
Welcome to UP-828 Ultra Programmer
Software Version: 1.1.8.52, Updated Date:8/30/2022
Selected device: [Intel] GT28F320C3T @uBGA48 #UBGA48
Setting Device Config
Setting completed.
This device default program algorithm is "NOR_Normal"
Connecting to a programmer.
No connected any programmer.
The programmer site #1 has been connected to the USB port #1
Selecting device
Selected device: [Micron] MT29F2G08ABAEAWP @TSOP48 #TSOP48
This device default program algorithm is NAND_Skip
Reconnecting to the programmer.
The programmer site #1 has been connected to the USB port #1
Creating the buffer.
Great completed. Default data is FFh. Elapsed time 0.69s
Calculating the buffer checksum.
Buffer Checksum: 6F800000 (CheckSum32)
Calculate completed. Elapsed time 0.06s
Start read device (Program Algorithm "NAND_Skip")
Insertion test.
Check device ID.
Check completed.
Clearing buffer.
Completed clear.Fill buffer for FFh. Elapsed time 0.30s
Checking bad block (All 2048 blocks) ....
Check completed. Elapsed time 7 .14s
Reading NAND, all 2048 blocks (0 - 2047) ...
Read success. Elapsed time 34.80s
 Read device completed. Elapsed time 44.11s
Calculating the buffer checksum.
Buffer Checksum: 3C108376 (CheckSum32)
Calculate completed. Elapsed time 0.39s
Save the file, C:\Users\Maggie Gaffney\Desktop\Chip Read - KR Case\Micron
TSOP48 29F2G08ABAEA - Telematics.bin
>>Save completed. Elapsed time 1.42s
MOS: a44a333853de3780200b8c26dbcc6c2c

The third chip from the Telematics module was a Spansion FL 116KBF4

The Spansion FL 116KBF4 was removed from the PCB, however it was not read at the
time of the extraction as it was determined to be flash memory.
Analysis

I was able to view the three chip images on my forensic machine. My forensic machine
is a "Forensic Drone" running Microsoft Windows 11 Pro with an Intel i9 processor and
32GB of Ram. All hardware and software utilized during this analysis was operating at
peak performance with no issues noted.

I utilized several programs to view data from the images provided. The programs
ranged from FTK lmager ver. 4.7.1.2, Autopsy ver. 4.21.0, Cellebrite Physical Analyzer
ver. 7.65., and Sysinternals Strings with Windows.
I was asked to find any evidence of GPS data inside of the images that were
downloaded from the Infotainment and Telematics Module. After a lengthy review
utilizing a combination of the afore mentioned programs, I was unable to locate any
GPS data within the data sets.

Conclusion

I advised Detective Guarino of my findings and provided him with this report. There
were no additional reports or summaries generated from the software programs listed.