Expert tells trial of 14 text files 'of interest' found on missing Elaine's computer

The expert - a financial crimes analyst - told the Central Criminal Court that he was able to extract text messages from two iPhones that had belonged to Ms O'Hara.

He was giving evidence in the trial of architect Graham Dwyer (42), of Kerrymount Close, Foxrock, who is pleading not guilty to the murder of Ms O'Hara (36) at Killakee, Rathfarnham on August 22, 2012.

Ms O'Hara, a childcare assistant from Killiney, was last seen alive near Shanganagh Cemetery in Shankill that day.

REMAINs

Her remains were found by a dog walker in undergrowth in the Dublin mountains on September 13, 2013.

The prosecution maintains Mr Dwyer killed her for his own sexual gratification.

The jury heard the financial crimes analyst, who has a qualification in cyber crime investigating, cannot be named for legal reasons as he currently works for the Criminal Assets Bureau.

He told Prosecution Barrister Anne Marie Lawlor he was called upon on August 29, 2012 to assist in the garda investigation because of his expertise in examining devices.

At this point, the probe into Ms O'Hara's disappearance was a missing persons investigation.

He was asked to examine two iPhones belonging to Ms O'Hara.

He used a forensic tool to extract information from the two phones. The tool was used to extract text messages that were both sent to and received.

He explained that some were text messages and some i-messages that were sent between iPhones.

The extraction of one phone was completed on August 29, 2012 and the second the following day.

A printed report of the contents was sent to the incident room at Shankill Garda Station.

Ms Lawlor said the content of the report and the texts would be made available to the court and the jury in "due course".

The witness said about a year later, the information was put on a thumb drive.

After this, in December 2013, he was given a forensic image of a hard drive from an Apple Mac computer belonging to Ms O'Hara.

He was assisting a colleague and the belief was that Ms O'Hara had been syncing her phones to the computer from time to time.

RECOVERY

On January 16, 2014 he used a data recovery tool to search for files on the hard drive's forensic image.

"You were in a position to ascertain there were quite a number of SMS files," Ms Lawlor said. "There were about 14 files of interest," he replied.

The court also heard from Detective Garda Brid Wallace of the Garda computer crime unit who said she became involved in the investigation in September 2013 after Ms O'Hara's remains were recovered.

She said she contacted Det Gda Cathal Delaney who initially examined Ms O'Hara laptop a year earlier, and requested his findings.

Det Gda Wallace told Ms Lawlor that she created a forensic image of Ms O'Hara's hard drive, so she took an identical copy of all the information on it without interfering with the original device.

She had noticed in Det Delaney's files that several messages had been discovered on Ms O'Hara's iPhone from the number 083 1103474.

That number had been saved in this phone under the contact 'David', Ms Lawlor said.

Det Gda Wallace said she ran keyword search and discovered messages between Ms O'Hara and the 083 number which she called "unallocated clusters".

By searching the number she also found a calendar entry on June 30, 2011, stating: "Graham's phone number 083 1103474" and another on the same date saying: "school finished for summer", the court heard.

The officer was asked by Ms Lawlor if she uncovered any other messages between Ms O'Hara and the 083 number.

"There was a large number of messages extracted," she replied.

The court heard other computer experts were drafted in to examine the contents of the message and extract the exact dates and times they were sent.

A colleague, Det Sgt Alan Browne, could set out dates and time frame, however Det Gda Wallace believed there were more unallocated clusters on the hard drive than he had found. The trial continues.

hnews@herald.ie