Graham Dwyer Trial: Message to Elaine's mobile read 'Must get fit for the murder', court hears
*Forensic officers extracted thousands of text messages from Elaine's laptop
*'Terrible 15pc pay cut and came 5th in flying,' one recovered text said
*'Glad u enjoyed the other night many more sessions like it to come!' read another
A RECEIVED text message reading: ‘Must get fit for the murder’ was found on Elaine O’Hara’s laptop, the Central Criminal Court has heard.
Forensics officer Det Sgt Alan Browne told the jury he technically examined Ms O'Hara's Apple Mac laptop and extracted thousands of text messages which had been backed-up.
He was giving evidence in the trial of architect Graham Dwyer when it resumed today.
Mr Dwyer (42), of Kerrymount Close, Foxrock, is pleading not guilty to the murder of Ms O’Hara (36) at Killakee, Rathfarnham on August 22, 2012.
Ms O’Hara, a childcare assistant from Killiney, was last seen alive near Shanganagh Cemetery in Shankill that day.
Her remains were found by a dog walker in undergrowth in the Dublin mountains on September 13, 2013.
The prosecution maintains Mr Dwyer killed her for his own sexual gratification.
The court heard today files were recovered from 'unallocated space' on Ms O'Hara's laptop - which the court heard was free space on a hard drive where the remnants of deleted information and messages remain.
Several messages were recovered between Ms O’Hara’s iPhone and a number - 083 1103474 – in what was called unallocated clusters, Anne Marie Lawlor, prosecuting barrister said.
“Good, looking forward to getting new bike tomorrow to try and lose weight. Must get fit for the murder,” she read in one recovered text.
Another read: “Terrible 15pc pay cut and came 5th in flying,” she said.
The exact dates and times of the texts will he given at a later date, the court heard.
Detective Garda Brid Wallace, of the Garda computer crime unit, had earlier said she became involved in the investigation in September 2013 after Ms O’Hara’s remains were recovered.
She said she contacted Det Gda Cathal Delaney who initially examined Ms O’Hara laptop a year earlier, and requested his findings.
Det Gda Wallace told Ms Lawlor that she created a forensic image of Ms O’Hara’s hard drive, so she took an identical copy of all the information on it without interfering with the original device.
She had noticed in Det Delaney’s files that several messages had been discovered on Ms O’Hara’s iPhone from the number 083 1103474.
That number had been saved in this phone under the contact ‘David’, Ms Lawlor said.
Det Gda Wallace said she ran keyword search for number and in unallocated space – which she described as free space on a hard drive where the remnants of deleted information and messages were saved - and discovered messages between Ms O’Hara and the 083 number which she called “unallocated clusters”.
By searching the number she also found a calendar entry on June 30, 2011, stating: “Graham’s phone number 083 1103474” and another on the same date saying: “school finished for summer”, the court heard.
These were shown on a colleague forensic Apple Mac “to show that entry in user friendly method” Det Gda Wallace added.
The officer was asked by Ms Lawlor if she uncovered any other messages between Ms O’Hara and the 083 number.
“There was a large number of messages extracted,” she replied.
The court heard other computer experts were drafted in to examine the contents of the message and extract the exact dates and times they were sent.
A colleague, Det Sgt Browne, could set out dates and time frame, however Det Gda Wallace believed there were more unallocated clusters on the hard drive then he had found.
The court heard more than 4,000 text messages to and from Ms O’Hara’s phones were recovered from the computer’s hard drive.
Det Garda Wallace said she could see there were extra messages in the unallocated space on the hard drive that were not date and time stamped and she wanted these in a human readable format.
She asked Det Sgt Alan Browne to do this.
In evidence, Det Sgt Browne agreed with Ms Lawlor that when data was saved by the Operating System, it was indexed and able to be recovered from an allocated space.
However, when a file was deleted either by the computer or manually, it went into an unallocated space and could only be recovered by using forensic software.
The method used depended on whether the file was intact or un-intact. Det Sgt Brown explained that he was asked to look at messages which had been stored in SQ light files, which were databases containing text messages.
On March 21, Det Gda Wallace brought him the hard drive and made a forensic copy of it. Text messages were extracted from allocated and unallocated space.
“I recovered over 1,400 SQ light files and 14 had the table content that would be associated with an SMS database,” he said.
He said successive computer backups would result in data being deleted and sent to unallocated space.
In the afternoon, Ms Lawlor and Det Sgt Browne went through the methodology by which the text messages were retrieved from Ms O’Hara’s laptop and converted into a readable format.
Three more messages were used as examples and screenshots were shown to the jury.
Message Three, from the 083 1103474 number to an iPhone backed up to Ms O’Hara’s laptop, dated March 31, 2011 at 8.17am stated: “Yes, beautiful baby girl (name of child redacted) Glad u enjoyed the other night many more sessions like it to come! See u sometime over the weekend…”
Above this, text on the screenshot read: "Yes sir, Dying for more play sir!!"
Message Four was sent from an iPhone backed up to Ms O’Hara’s computer and was dated November 15, 2011.
It stated: “Sir any chance you get an 086 phone sim I get free texts?”
Message Five from the same date stated: “No problem. Away in Poland from tomorrow so see u sunday?” This was received by a phone backed up to Ms O’Hara’s computer and was sent from the 083 number.
Technical evidence from several more gardai involved in the computer crime unit was heard during the afternoon.
An uncontested statement by Det Garda Cathal Delaney was read to the court, stating he was handed Ms O’Hara’s two Apple iPhones and her Apple Mac laptop the weekend she was reported missing, as well as a Blue Netbook and an Apple ipod.
He took a forensic copy of the Apple mac and requested Det Sgt Paul Fitzpatrick to examine files.
Det Gda Delaney said he used forensic software to analyse Ms O’Hara’s devices after she was reported missing and discovered text fragments in an area of the Apple mac hard drive in unallocated space.
Several texts were to and from an 083 number and these were forwarded to the incident room.
Det Gda Delaney said he attempted to download the contents from an iPhone, but couldn’t as it was protected by a password he did not have access to.
He later extracted from information from the Sim card.
Det Garda Paul Fitzpatrick told the court he analysed back-up folders on the forensic copy of the hard drive from Mc O’Hara’s laptop.
The witness told the court he found ‘back up’ from three separate devices on it and used software to import the files so they could be displayed in a readable format.
One of the sub-folders was encrypted with a password but he identified an Apple iPhone, username "Elaine's iPhone" (086 3311207) which had been backed up 23 November 2010.
The same phone was backed up s second time on May 15, 2012, while he also found two back-ups of her iPod touch dated December 8, 2010 and June 20, 2012.
Elsewhere a second anonymous witness, known only as financial crimes analyst number one, said in December 2012 he supported a colleague who earlier gave evidence anonymously extracting a large number of text messages from the forensic copy of the hard drive.
More than 4,000 were recovered and put on a disc in a readable format and handed over to investigators, he added.
Anne O’Reilly of An Post gave evidence that gardai made a request on October 7, 2013 for assistance in relation to details of two top-ups for mobile phones. She retrieved information from An Post’s system for the top ups.
One, for €10, was purchased at Ballsbridge Deli, Merrion Road at 12.30pm on July 24, 2012.
The second, for €20 was bought at Centra, Cathal Brugha Street at 4.36pm on July 3, 2012.
An IT team leader with An Post, Micheal Spain, said Post Point, a subsidiary of An Post, was involved in the sale of top ups and other products.
The Centra at the time was a Post Point client using an Electronic Point of Sale system. The deli in Ballsbridge used a terminal for top-up sales.
He said both had unique identification numbers and were fully operational at the time to the best of his knowledge. Mr Spain said both top-ups that were purchased were for O2.
Cross-examined by Defence Barrister Ronan Kennedy, he agreed that a transaction may have already happened by the time it was registered to An Post’s system.
Pearl Clarke, Managing Director of Post Point told the jury all dealings with agents were by way of a unique identifier and the numbers were never duplicated or re-allocated.
Jim Whelan, a loss prevention manager with Carphone Warehouse Ireland said he was contacted by gardai on November 20, 2013 and asked to provide information on Ms O’Hara’s customer account.
Screenshots of the account showed the recording of a sale of a 3 network USB modem for internet connection on September 12, 2007.
Another sale was an upgrade to an iPhone 4S on May 30, 2012. Ms O’Hara physically signed a contract for that upgrade.
In cross-examination, Mr Whelan told Defence Barrister Kate McCormack there were two different mobile phone numbers attached to the two purchases.
He said identification would have been required because it was a bill pay contract.
Paul Healy, an employee of the 02 store on Grafton Street, Dublin, confirmed that at around 4.30pm on November 30, 2011, he sold two Nokia mobile phones to one person.
He said it was a pre-pay deal, and the customer did not have to provide any identification.
‘They do now, but not back then. There were no details given, other than the phone number,’ he said.
A receipt recorded just one telephone number – 086 175 1151. Mr Healy explained that there was only space on the receipt for one of the two handset numbers sold.
The receipt showed the sale of two Nokia 1616s, and that a total of E69.98 was paid in cash.
Brian Tobin, operations manager for electronic payments firm Payzone Ireland, later gave evidence about five top-ups brought through the company’s terminals.
The court heard this information was sought by gardai under section 8 of the Data Protection Act.
The top-ups included €10 credit purchased in the Centra store in Cornelscourt, Foxrock, at 10.53am on May 28, 2012.
Others included purchases from: Jones Deli on Lower Baggot Street, Dublin, on November 22, 2011; The Market Food Store, Belarmine, Stepaside, Dublin 18 on November 30, 2011; another from Jones deli on December 1, 2011; and a €40 top up in the 3 store on Grafton Street on March 24, 2011.
David Masterson, senior systems administrator with Payzone Ireland, confirmed there was nothing extraordinary before, during or after these purchases and they gave an accurate reflection of sales at that time.
Earlier a computer expert brought in by gardai said they found 14 text files “of interest” on her computer hard drive.
The expert - a financial crimes analyst - also told the Central Criminal Court that he was able to extract text messages from two iPhones that had belonged to Ms O’Hara.
The jury heard the financial crimes analyst, who has a qualification in cyber crime investigating, cannot be named for legal reasons as he currently works for the Criminal Assets Bureau.
He told prosecution Barrister Anne Marie Lawlor he was called upon on August 29, 2012 to assist in the garda investigation because of his expertise in examining devices.
At this point, it was a missing persons investigation.
He was asked to examine two iPhones belonging to Ms O’Hara. He used a forensic tool to extract information from the two phones. The tool was used to extract text messages that were both sent to and received.
He explained that some were text messages and some i-messages that were sent between iPhones.
The extraction of one phone was completed on August 29, 2012 and the second the following day.
A printed report of the contents was sent to the incident room at Shankill Garda Station.
Ms Lawlor said the content of the report and the texts would be made available to the court and the jury in “due course.”
The witness said about a year later, the information was put on a thumb drive. After this, in December 2013, he was given a forensic image of a hard drive from an Apple Mac computer belonging to Ms O’Hara.
He was assisting a colleague and the belief was that Ms O’Hara had been syncing her phones to the computer from time to time.
On January 16, 2014 he used a data recovery tool to search for files on the hard drive’s forensic image.
“You were in a position to ascertain there were quite a number of SMS files,” Ms Lawlor said.
“There were about 14 files of interest,” he replied.
The trial continues tomorrow before Mr Justice Tony Hunt and a jury of seven men and five women.