COLLETON COUNTY, S.C. (WCBD) – Tuesday marked another long and technical day of testimony as several witnesses took the stand in the Alex Murdaugh murder trial.
Murdaugh is accused of killing his wife Margaret and youngest son Paul at their family property in June of 2021.
ALEX MURDAUGH MURDER TRIAL: DAY 6 RECAP
Get caught up on the Alex Murdaugh investigations
Tuesday’s testimony focused mostly on controversial video, guns, and cell phone data.
During cross-examination of SLED special agent Jeff Croft, Murdaugh’s attorneys addressed what has become a flashpoint — video in which prosecutors claim Murdaugh may have admitted to murdering Paul.
Defense offered a different interpretation of what Murdaugh said on the tape and encouraged the jury to decide for themselves.
Croft remained unswayed, despite the video being played several times and slowed down. Murdaugh’s attorneys drilled him on why he did not take more action if such a seemingly huge revelation was made.
They also questioned Croft about guns, pointing out that the type of ammunition used to kill Paul was not found anywhere else on the property.
Murdaugh’s cousin, DNR agent John Bedingfield, also testified about guns. He is a licensed firearm dealer who built several 300-blackouts for Paul and Buster.
The remainder of the witnesses gave lengthy and extremely technical testimony about cell phone data. The final witness, Lt. Britt Dove with SLED, gave the most digestible summary of information found on Maggie’s phone. He went through a detailed log of the phone’s activity, with some of the high points being that the last text read on the phone was at 8:49 p.m. Then, there was activity such as orientation changes, steps recorded, and a possible attempt to do a biometric unlock, recorded after Maggie was presumed to have died.
Britt’s testimony is expected to pick up Wednesday at 9:30 a.m.
ALEX MURDAUGH MURDER TRIAL LIVE BLOG:
5:40 p.m. – Court adjourned. Testimony will resume at 9:30 a.m. Wednesday.
4:25 p.m. – Court resumes. The state introduces the call log report into evidence.
They focus on Maggie’s call log from the night of June 7.
An outgoing call was made to someone named Barbara at 7:50 p.m. That call lasted just under three minutes.
Dove says that was the last call that was placed from or answered on Maggie’s phone.
Maggie had five missed calls from Alex, one at 9:04 p.m., two at 9:06 p.m., one at 9:45 p.m., and one at 10:03 p.m.
They move on to discussing Maggie’s texts.
A group chat including Maggie, John Marvin, Alex, and several other people is shown as evidence. A message from John Marvin came in at 8:31 p.m. The message was read when it came in.
The message said, “I plan to go over to visit dad tomorrow afternoon, is anyone else planning to go?” The chat appears to be talking about visiting Murdaugh’s father, who was sick at the time.
Another message in the group chat came in from “Lynn G.” It was read at 8:49 p.m. That was the last text read on Maggie’s phone.
A text from Alex at 9:08 p.m. went unread.
Dove acknowledges that he can’t determine who read the texts or answered the calls, but whoever did had to have Maggie’s password or have their face as one of the recognized biometric markers.
They move on to discussing a device activity log from June 7, 2021, such as orientation changes, the phone being locked or unlocked, the phone being plugged in to charge, etc.
The phone was unplugged at 8:17 p.m. Dove said it could’ve been plugged into a wall, vehicle, or computer.
A timestamp from the app Poshmark was recorded at 8:30 pm.
The display came on at 8:49 p.m., meaning the screen lit up. Dove said it could’ve been because of a notification or because of movement such as walking, bumping a phone, picking it up, etc.
At 8:49 p.m., a text received minutes earlier was read.
An orientation change was logged around the same time. Dove said a human holding a phone is the main thing that would cause an orientation change.
The device was locked at 8:49:31 p.m. It was not unlocked again that night. It was unlocked again June 8 at 1:10 p.m.
After the phone was locked at 8:49:31 p.m., the display went off at 8:53 p.m.
At 8:53:24, there was an orientation change. At 8:54 p.m., there was another orientation change from landscape. Also at 8:54 p.m., the camera comes on for around one second.
Dove said it appears the phone is being moved and the camera is activating in the background to see if it recognizes a face to unlock. It does not unlock.
At 8:55:32 p.m., the phone showed an end time for orientation portrait. Dove says that would indicate the phone was being held in someone’s hand.
At 9:00 p.m., the phone registers steps taken and a distance traveled. Dove said the steps may not have happened at exactly 9:00 p.m., but likely between 9:00 p.m. and 10:00 p.m.
At 9:06:12 p.m., an orientation change to portrait began. Dove said he believes that would indicate somebody lifting the phone. There were no more orientation changes that night.
Phone calls from Alex came at 9:06:14 p.m. and 9:06:51 p.m.
At 9:07 p.m., the display came on.
Alex texted Maggie at 9:08:58 p.m. The text said “going to check on him, be right back.”
There was exactly two minutes and seven seconds between Alex’s call and his text.
Nothing happens for 22 minutes. At 9:31 p.m., the display comes on, but there are no notifications or anything associated with it.
At 9:47 p.m., Alex sent a message saying “call me, babe.”
38 steps were recorded on the phone at 8:17 p.m. that night. Dove said the number of steps might not be exact.
43 steps were recorded by the phone at 8:30 p.m.
59 steps were recorded by the phone between 8:53 p.m. and 8:55 p.m. The phone did not record any more steps that night.
4:05 p.m. – The jury is sent to the jury room for a 15-minute break.
3:15 p.m. – Lt. Britt Dove with SLED is called to the stand. He works in the computer crimes center. He is an expert in cell phone forensics.
Dove describes the different ways data can be extracted from a phone.
Dove processed Maggie’s, Alex’s, and Paul’s phones.
He extracted and analyzed data from Maggie’s phone using three different programs. One program extracted the data, the other two programs analyzed the data. He used two programs to validate the information being decoded, ensuring they were both producing the same results.
Dove did the same process on Alex’s phone.
Dove was not able to unlock Paul’s phone, so he sent it to VanHouten.
Dove describes the different kinds of data that can be taken from the phone including surface-level data like texts and photos, as well as more in-depth information like when the phone was plugged in or turned sideways.
Several different data bases store location data, according to Dove. Some of that is based on settings users choose for each app. Phones can store location based on different things, such as nearby cell phone towers, GPS, etc.
Dove confirms that extracting data does not alter the data in any way.
Prosecution asks how cell phone time is set. Dove says the time is set through the provider. When comparing events on two different phones, Dove says the time references should be synced because the phones are synced through the server.
Prosecution shows Dove Maggie’s phone. Dove says he received the phone in June of 2021, logged it, took photos of it, and began processing it.
Dove says that when he received the phone, it was on but in airplane mode.
He goes through Maggie’s location settings, identifying which apps she allowed to track her locations and how often. Most of the apps were only allowed to track her location “while using.”
A photo Dove took of Maggie’s recent call log is shown.
It shows five missed calls from Alex, one missed call from Buster, and two missed calls from John Marvin. The call log does not show the calendar date or times.
Dove also took a photo of Maggie’s messages app.
It shows several unread/unopened messages.
Dove says the entire extracted report from Maggie’s phone was probably over 16 gigabytes. He put all of the information on an external hard drive. Dove explains that the information contained in the phone and the information on the external hard drive are exactly the same.
A report for just Maggie’s call logs from June 5 through June 7, 2021 is presented.
3:03 p.m. – Defense begins cross-examining Bedingfield. Griffin asks about the first two 300-blackouts, one of which was black and one of which was tan. The replacement was black, according to Bedingfield. Griffin says the tan one was lost, so as of 2018, they had two black 300-blackouts.
Griffin asks about the price difference in the guns and why the replacement gun was so much cheaper. Bedingfield identifies the accessories, paint job, and slings on the first guns as the reasons for them being so much more expensive.
Griffin asks about Murdaugh’s relationship with his sons. Bedingfield says it was good.
2:40 p.m. – The jury returned. The state called John Bedingfield, a DNR agent who has a side job building guns, to the stand. Bedingfield was the subject of portions of Croft’s testimony Monday because he built guns for the Murdaughs.
He is also Murdaugh’s cousin.
Bedingfield says Murdaugh approached him around Christmas of 2016 and asked him to build some guns for his sons to hunt pigs with. Bedingfield said he suggested a 300-blackout. He suggested the guns have silencers and thermal optics for night hunting, but a background check was required for the silencers, and Murdaugh never completed the paperwork. He paid for the silencers (around $1,000 each) but they were not put on the guns.
Murdaugh asked Bedingfield in 2018 to make him a third 300-blackout because Paul’s gun was lost or stolen. That gun did not have a thermal optic because they are expensive (he estimates around $1,500 each) and the previous gun was lost/stolen.
Murdaugh paid over $9,000 for the first two guns. He paid $875 for the third. Bedingfield said that the third one did not have the same modifications as the first two, which accounted for part of the difference in price.
Bedingfield said that he got a call from Croft after the murders asking about the guns he built for Murdaugh. He initially only sent Croft the paperwork for the first two, then realized that he missed one and sent the paperwork for the third.
2:30 p.m. – Court resumed. Prosecution and defense argued about the admission of Paul’s phone as evidence, with defense claiming a sufficient chain of custody was not established. Judge Newman sided with the state, saying they had established a sufficient chain of custody and proved the phone had not been tampered with.
12:56 p.m. – Defense has no questions for VanHouten. Court is in recess until 2:15 p.m.
12:43 p.m. – The state calls Jonathan VanHouten, a U.S. Secret Service employee and veteran law enforcement investigator, to the stand.
He was asked to help unlock Paul’s phone as well.
VanHouten likens an iPhone lock to a bank vault. He says he can’t get data off the phone until it is unlocked.
He used software that tries to force the device to unlock, paired with a series of codes that he thought may be the passcode (birthdays, anniversaries, etc). If none of those work, a four-digit code is limited to 146 attempts per day. It could take up to two months. If the phone has a six-digit code, it could take up to 19 years.
VanHouten was successful in getting Paul’s phone unlocked. He extracted the data, but did not examine it. The data was placed on a hard drive and provided to SLED.
VanHouten is asked about Faraday Bags. He says that the bags prevent remote wipes of the data on the device. Prosecutors ask if there are other ways to prevent remote wipes. VanHouten says yes, turning the phone off or in airplane mode prevent the remote wipes.
12:42 p.m. – Defense asks McManigle if the phone was dead when he received it McManigle says he doesn’t recall if the battery was dead, but the phone was off and he did charge it.
12:34 p.m. – Paul McManigle, Charleston County Sheriff’s Office and U.S. Secret Service agent on the cyber crimes task force is called to the stand.
He was asked to redact the attorney-client privilege information on Murdaugh’s phone as it was being investigated by SLED. He did not decide what information was redacted, that information was decided by an attorney with the Ninth Circuit Solicitor’s Office.
McManigle says call logs were not redacted.
McManigle was also asked to try and unlock Paul’s phone, but was unsuccessful.
Paul’s phone is presented as evidence.
State rests.
12:30 p.m. – Prosecution follows up and asks if the records distinguish between a phone being off and going to voicemail. Knitch says they don’t distinguish.
Harpootlian follows up with a question about geolocation. He asks if the records give GPS. Knitch says they give the cell phone tower that the phone is pinged on. Harpootlian asks if, in a rural area with only a few cell towers, it would be hard to triangulate. State objects and says Knitch is not an expert on triangulation. Knitch is allowed to answer and says he is not an expert on triangulation. Harpootlian asks if he was going to say that before the state objected, Knitch says yes.
12:15 p.m. – Defense attorney Dick Harpootlian asks Knitch about his role at Verizon. He then asks for clarification on how to determine whether calls where outgoing, incoming, answered, terminated, or forwarded.
Harpootlian asks when is the first time Maggie’s phone when to voicemail. Knitch says that a call went to voicemail, then Maggie made two outgoing calls. Her last outgoing call was at 7:50 p.m. There were no inbound answered calls after 7:50 p.m.
No calls were placed on June 9 from Maggie’s phone. All incoming calls were routed to voicemail.
Harpootlian asks if texts are included in the records. Knitch says yes.
Harpootlian asks if records from any other phone were subpoenaed. Knitch says he is not aware of any. Harpootlian asks if any other information was collected as part of the search warrant. Knitch says he is not sure. Harpootlian asks how long records are usually kept, Knitch says that unless there is a search warrant for a phone, the records are usually only kept for 18 months.
Harpootlian asks how long a phone rings before it goes to voicemail. Knitch says there is no set time. He says when a phone rings it is really the network trying to locate the phone and connect with it. Harpootlian asks what happens if someone calls and it rings but the caller hangs up before it gets to voicemail. Knitch doesn’t exactly explain.
11: 40 a.m. – Court resumed. The state called Michael Anthony Knitch to the stand. He is a custodian of records at Verizon Wireless.
The state introduces cell phone records from the following phones as evidence:
- Alex Murdaugh
- Paul Murdaugh
- Maggie Murdaugh
- Buster Murdaugh
- CB Rowe
- Marty Cook
- Connor Cook
- Rogan Gibson
Knitch confirms the records are true and accurate. The search warrant spanned from May 1, 2021 to June 10, 2021.
Prosecutors then go on to show how the records are presented in an Excel spreadsheet. Knitch explains each column.
Prosecution then begins discussing specific data points, including calls made on Maggie’s phone the night of the murders.
They discuss a call made by Maggie at 7:50 p.m. and an incoming call to Maggie at 9:04 p.m. The 9:04 p.m. call went unanswered.
Several more calls come in to Maggie’s phone after 9:04 p.m. All go unanswered.
They move on to call records from Murdaugh’s phone. Records show a call made to Maggie at 9:04 p.m. Several other calls are made by Murdaugh over the next hour.
The state rests.
11:28 a.m. – Court took a brief recess.
11:19 a.m. – In a brief second round of cross-examination, Griffin asks Croft if anyone else was in the circle of interest on June 10. Croft says they had a few names of interest.
Griffin asks about some of the shells admitted into evidence and when they were seized. Croft says they were seized on September 13, 2021, four months after the murders. Griffin asks if the property had been secured in the intermittent period. Croft says no. Griffin asks if any of the evidence was known to have been on the property the night of the murders. Croft says no.
10:50 a.m. – Proseuction follows up with questioning. Creighton Waters asks about COVID-19’s impact on the availability of ammunition at the time of the murders. Croft says ammunition was more scarce during that time. Waters asks if there was a lot of ammunition in the Murdaugh’s home. Croft says yes.
Waters asks about what the lab report found and about Croft’s qualifications in ballistics analysis. Croft says he is not qualified to make those assessments.
Waters asks about the ammunition in the shotguns. Crofts says he found weapons that had mixed loads. They go through several pieces of ammunition admitted into evidence.
Waters asks about why Croft did not write anything down during the interview and whether Murdaugh was a suspect at that point. Croft says no.
9:39 a.m. – Defense attorney Jim Griffin begins cross-examination of SLED special agent Jeff Croft. He asks about Croft’s role in the case searching the home and investigating firearms.
He asks if the search was part of a search warrant. Croft says there was a warrant obtained earlier, but the search was a consent search. Griffin asks if Croft knows that the warrant was all-encompassing and that they could’ve searched the whole house for anything. Croft says he was focused on the gun room. Griffin asks if Croft knows of anyone searching for bloody clothes. Croft says he was focused on the gun room.
Griffin moves on to ask about guns and ammunition.
He asks why guns were introduced into evidence if they were not the murder weapons. He asks if SLED tested those weapons and found that they were likely not the murder weapons. Croft says he does not have the report and can’t answer that.
Griffin asks Croft if SLED has ever found the murder weapons. Croft says not that he is aware of.
Griffin introduces some boxes of ammunition and asks Croft about the difference between led and steel ammunition. Croft says that steel is used for waterfowl and led is used for everyday hunting – rabbits, squirrels, doves, etc.
Griffin asks if Croft collected any waterfowl ammunition from the property. Croft says no. Griffin asks if Croft found any steel ammunition around Moselle during his search. Croft says no. Griffin asks if Croft is aware that the shot that killed Paul was a steel shot. Croft says he was aware. Griffin asks if any similar ammunition was found anywhere around the property. Croft says no.
Griffin moves on to ask about how Maggie’s phone was located. Croft says that John Marvin Murdaugh assisted with locating it via Find my iPhone. The phone was located a few hundred yards outside of the family property.
Griffin asks if anyone had a Faraday Bag, which prevents any outside sources from tampering with the phone. Croft said that the phone was not put in a Faraday Bag when it was seized.
Griffin asks about whether Murdaugh was being looked at as a potential suspect on June 8. Croft said yes. Griffin acknowledges it is common for the person that finds the bodies, especially when they are close to the victims, to be looked at.
Griffin asks if they had a label for Murdaugh that day: person of interest, suspect, etc? Croft says they were looking at him as the person who found the bodies. He says the circle of interest is the crime scene and people there (Maggie, Paul, Alex). They investigate that circle and work their way out. Griffin notes Murdaugh was the only living person in that circle.
Griffin asks if Croft was aware of media reports June 8 that Murdaugh was a person of interest. Croft says he tries to avoid media reports to avoid influence.
Griffin asks about the SLED statement issued on June 8 saying there was no threat to the public. Croft says he was not aware of the statement.
Griffin asks if anyone from SLED went June 8 to search Murdaugh’s mother’s house, where Murdaugh claimed he was the night before, to confirm his alibi. Croft said that he did not go, but he can’t testify to what other agents did. Griffin asks why no one went to check the house for inculpatory or exculpatory evidence to help determine Murdaugh’s role. Croft says he can’t testify to what-ifs.
Griffin asks about Murdaugh’s law partners that were there on June 8. He asks if they were there as friends or if Murdaugh was “lawyering up.” Croft says they were giving counsel. He says they also pointed out some things to investigators as they searched the scene.
Griffin asks about subsequent searches. Croft says that Murdaugh gave consent to every search.
Griffin moves on to asking about evidence seized in a subsequent search, a 300-blackout clip found in a black Ford F-150. Griffin asks if any analysis of the evidence was done or if any finger prints were taken. Croft says it doesn’t appear so. Griffin asks why untested evidence that has no apparent connection to the crime was brought in as evidence. Croft says he does not know. Griffin reminds Croft that Murdaugh told him in the June 10 interview that Paul leaves everything — including guns and ammunition — everywhere. Griffin asks if ammunition being left in a truck would fit that pattern. Croft says it could.
Griffin asks if anyone went to a dirt mount at the end of the shooting range to dig through and look for projectiles. Griffin asks if projectiles from that mound could’ve been sent to SLED for comparison to other projectiles found at the crime scene and around the property. Croft says a lot of elements go into that. Griffins specifically suggests they could’ve compared those to the 300-blackout rifle seized from the scene.
Griffin moves on to asking about the interview with Murdaugh conducted on June 10. Griffin says John Marvin, Randy, and Buster Murdaugh were also interviewed that day. They were each interviewed by two agents around the same time.
Griffin asks about Croft’s testimony that Murdaugh said “it was so bad, I did him so bad,” describing Paul’s murder. He asks if Croft is 100% sure Murdaugh said “I” and not “they.” Croft says he is 100% sure that is what he heard.
Griffin asks what he did in response. Croft says he made a mental note, it was still preliminary, and they didn’t have information to challenge Murdaugh on any of the statements.
Griffin asks why, if Murdaugh was being looked at as a possible suspect and apparently just said “I did him so bad,” did they not do anything further. Croft says a third interview was conducted. Griffin asks if Croft asked Murdaugh in the third interview — which was conducted August 11, 2021 — what he meant by his statement. Croft said he didn’t.
Griffin again asks Croft on why they didn’t press Murdaugh on what he meant by that statement during the interview. Croft says it was still early and they didn’t want to challenge Murdaugh. Griffin asks if Croft thought maybe he could have meant “I did him so bad,” as in “I wasn’t a good father.”
Griffin points out that Croft was taking notes at that time. Griffin asks why Croft only made a mental note and didn’t even write it down.
The clip is played again in court multiple times both in real-time and slowed down. Griffin asks Croft if he heard anything different. Croft says no, but acknowledges the jury gets to make up their own minds.
Griffin moves back to the August interview. He asks Croft if he advises people they are being recorded. Croft says he never does. Griffin points out that Murdaugh asked for the meeting to get an update on the investigation.
During the August meeting, Croft says Murdaugh was asked point-blank if he killed Maggie and Paul. At that point, Croft says Murdaugh was only a person of interest, not a full-on suspect.
Griffin questions Croft about interviews conducted with Maggie’s family. He asks about several names provided by the family and whether interviews were conducted with any of those people. Croft says he does not know.
Defense rests.
9:36 a.m. – Court is in session. Before bringing the jury in, defense attorney Dick Harpootlian asked to put on the record his team’s gratitude to the clerk of court, the Colleton County Sheriff’s Office, and all parties involved. He said that he has tried many cases in many jurisdictions and never has been treated with more courtesy. That sentiment was echoed by the prosecution.
—
STAY CONNECTED: Receive news alerts from this trial and watch it on the go with the NEWS 2 APP (download it here). You can also subscribe to daily emails for the latest news on this trial.