Lessons in Digital Evidence Collection from the Karen Read Trial

The Karen Read case became one of the most closely watched criminal trials in Massachusetts history. Read was accused of killing her boyfriend, Boston police officer John O’Keefe, by striking him with her Lexus SUV and leaving him outside a home in Canton, Massachusetts, during a snowstorm on Jan. 29, 2022. Prosecutors alleged that Read intentionally hit O’Keefe after a night of drinking. The defense argued that O’Keefe entered the home, was injured there and that investigators failed to properly investigate alternative explanations for his death. As the case unfolded, public attention expanded beyond the question of guilt or innocence to the quality of the investigation itself, with disputes arising over crime scene processing, evidence preservation, digital forensics, witness testimony and chain-of-custody procedures. The trial ultimately served as a prominent case study in how investigative practices can come under intense scrutiny when physical and digital evidence form the foundation of a criminal prosecution.

Digital forensics specialist Derek Ellington, CFE, used the high-profile Massachusetts case as a training exercise during the 37th Annual ACFE Global Fraud Conference. He examined evidence handling practices, chain-of-custody procedures and digital forensic challenges in modern investigations. Part one of his session focused on how investigative decisions can affect the reliability of evidence presented in court.

Cyber Ninja’s Rules of Evidence

Ellington opened with what he called the “Cyber Ninja’s” rules of evidence: Be quick, be greedy, be there and treat everything as evidence. As he explained, electronic evidence is inherently dynamic and may disappear through routine system retention policies even when nobody intentionally alters it. “The clock is always ticking,” he said, noting that logs, cell tower records and other digital data can be lost within days or months if not preserved promptly.

He emphasized that investigators should preserve as much information as they can and maintain close control over evidence collection and documentation. He also stressed the importance of maintaining a clear chain of custody, which tracks who collected evidence, where it originated, how it was handled and every transfer or access that occurred afterward. Even forensic copies require their own separate chain of custody, he explained, adding that any person who accesses evidence should be documented. “Mishandling or failing to document the evidence” is one of the primary reasons why evidence is excluded in court, he said.

Disputed Evidence

Using the Karen Read case timeline, Ellington outlined numerous evidence-related controversies surrounding the investigation into the death of O’Keefe. He highlighted alleged shortcomings involving crime scene preservation, collection of biological evidence, digital evidence preservation and witness device acquisition. In particular, he cited the failure to preserve neighboring Ring camera footage, the use of red plastic cups and a grocery bag to transport blood samples, delays in processing physical evidence, and questions surrounding the handling of O’Keefe’s clothing and vehicle-related evidence.

Throughout the presentation, Ellington repeatedly pointed to missing or incomplete chain-of-custody records when discussing evidence in the Read investigation, including questions about the seizure, transfer and processing of key items.

A substantial portion of the session focused on mobile phone forensics. Ellington reviewed timelines associated with the seizure and imaging of O’Keefe’s and Read’s phones, highlighting evidence that suggested the devices continued receiving notifications, collecting location data, running applications and generating screenshots while in law enforcement custody. Incoming messages, application activity, GPS records and screenshots appeared on the device during periods when it should have been isolated. He asserted that digital activity after seizure raised questions about whether proper isolation procedures, including the use of airplane mode or Faraday protection (using conductive enclosures to block electromagnetic fields), were consistently followed.

Other disputed evidence included surveillance footage, vehicle navigation data, witness phones, deleted records and the handling of digital records from those connected to the case. According to Ellington’s analysis, failures to preserve potential evidence and delays in forensic acquisition increased uncertainty about the reliability of some data sources.

Preserving Evidentiary Integrity

Electronic evidence is especially vulnerable to alteration through intentional actions and routine device activity, Ellington told fraud examiners. He maintained that investigators must clearly separate actions taken by suspects, victims and law enforcement to preserve evidentiary integrity. Ellington added that the central issue wasn’t necessarily what the digital evidence ultimately showed but whether investigators could confidently demonstrate its reliability. He argued that jurors shouldn’t be forced to determine whether evidence was properly preserved, authenticated or altered during collection. Instead, those questions should be resolved through sound forensic practices before evidence reaches the courtroom.

Investigators must clearly document any interaction with digital evidence and avoid actions that create uncertainty. “There is and will always be a high level of uncertainty regarding the validity and accuracy” of evidence when collection and preservation procedures aren’t consistently followed, Ellington said.