A key piece of evidence in Alex Murdaugh’s murder trial was cellphone video that captured his voice in the kennels of his family’s sprawling Lowcountry estate — the place where his wife, Margaret, and son Paul were found fatally shot on June 7. 2021.
The disgraced South Carolina attorney had told authorities he was not there the night of the murders. But the video – taken by Paul and stored on his phone – showed that was the case.
It took investigators months to recover the video, even though the locked device’s six-digit passcode was as simple as possible: 041499, Paul’s birthday.
To learn more about the case, listen to “The Murdaugh Murders: Inside the Investigation” on “Dateline” at 9 ET/8 CT tonight.
In his first interview on the case, the South Carolina investigator accused of hacking the phone told NBC News’ “Dateline” why the process took so long, how law enforcement was ultimately able to access it and how surprised the authorities were when they discovered the affair. video.
“I was in disbelief,” said Lt. Britt Dove, computer crimes investigator for the State Law Enforcement Division. “I shouted that I didn’t find it to anyone in particular because I was alone in the office.”
Murdaugh, who has proclaimed his innocence in the murders of Margaret, 52, and Paul, 22, admitted lying to authorities about his alibi the night of the murders.
During his trial, Murdaugh, 55, blamed the deception on his addiction to painkillers and paranoia. He was convicted in March and sentenced to life in prison without the possibility of parole.
Murdaugh’s lawyers appealed the conviction, alleging in court papers filed in September that a county official tampered with the jury. An appeals court agreed to allow Murdaugh, who pleaded guilty Friday in a separate financial crimes case, to seek a new trial.
Dove said she obtained Paul’s iPhone on August 13, 2021, nine and a half weeks after the murders. Investigators already knew that gaining access would be essential: On the night of the murders, Alex told the case’s lead detective, David Owen, a senior special agent with the South Carolina Law Enforcement Division , that he had not gone to the kennel.
Murdaugh told Owen that he had stayed at a house on the property and that after dinner he took a nap while his wife went to the kennel, Owen told “Dateline” in his first interview on the ‘affair.
At 10:07 p.m., Alex called 911 and announced that he had found the bodies of his wife and son.
But within 24 hours, Owen said, a Murdaugh family friend had provided investigators with details disputing that version. Paul was caring for his friend’s dog – a chocolate Lab named Cash – and he called his friend the night of the murders to tell him about a problem he was having with Cash.
The friend, Rogan Gibson, told investigators that while speaking with Paul, he was almost certain he heard Alex in the background, Owen said. Gibson mentioned something else: Paul had tried to send him a video of the dog but was unable to do so because of spotty cell coverage, Owen said.
The password problem
After the murders, authorities obtained Paul’s iPhone almost immediately, Owen said. But it was locked and the authorities did not know its password.
Apple only allows users to enter the wrong password a few times before the phone is permanently disabled. To access the device afterwards, it must be reset – a process that would erase everything on it, including videos.
When Dove received the phone, he said it was temporarily disabled, with a message asking him to re-enter a password in a few minutes. He said he wasn’t sure who entered the wrong code or how many times they did it.
Investigators had provided Dove with about 20 numbers that he described as important dates associated with Paul, he said. Some were birthdays, Dove said, but none were Paul’s.
Although a date of birth might seem like an obvious choice for a password, Dove said that in his experience (he’s been a computer crimes investigator for 15 years), the codes used vary.
Some select random numbers, Dove said. Others use street numbers or a spouse’s birthday.
“You can’t say the first three will always be an anniversary,” he said. “It just changes from person to person.”
Dove tried a few combinations from the list, but they didn’t work, he said. And he tried to break in with a “brute force attack,” or a forensic tool that systematically tries different combinations on a phone until it finds the right one.
These tools, which allow investigators to bypass manually entering a passcode, can take years depending on the complexity of the code, Dove said. In another case, Dove recalled, it took authorities two years to break into a phone using a brute force attack.
The technique recovered little from Paul’s phone, and investigators still haven’t been able to search the entire device, Dove said. So he decided to wait and wait for a technological breakthrough that could help them crack Paul’s password.
“I had to be aware that if we tried these attempts and failed, we could have potentially lost information on this,” he said. “And once we lose that information – even six months from now, a year from now, (when) we could have accessed it – it doesn’t do us any good because the information is gone.
As months passed and the investigation stalled, Dove said he finally heard of a company that could access the phone, figure out its password and process the device. The U.S. Secret Service would help in the process, Dove said, so he sent the phone to the agency.
But before federal investigators shared the device, Dove said, they decided to make another attempt to unlock the phone using a passcode Dove hadn’t tried: Paul’s birthday.
It worked, Dove said, and by the end of March 2022, he had retrieved the device and obtained a copy of the video Gibson described.
The crucial clip
The brief clip, which had a timestamp of 8:44 p.m., contained three distinct voices, Dove said: Paul, who shoots the video and catches the dog, Cash; his mother, who is heard shouting that another dog, Bubba, has a “bird” in his mouth; and a third voice – Alex’s – which was also shouting at Bubba.
Dove said he watched the video once, then turned up the volume and watched it again.
“Then I put on headphones to make sure I was hearing what I thought I was hearing,” he said, adding: “This, we knew for sure at the time, simply destroyed any alibi that had been put forward.”
After watching the video several times, he called Owen, who remembers thinking he now had “hard evidence” that Alex was lying.
“That put Alex in the kennel when he said he wasn’t there,” Owen said, adding, “I was excited. I was really excited.”
Alex’s lawyers eventually came up with a name for what the video showed: “the lie.”
“How do I get around this?” Dick Harpootlian, one of those attorneys, told “Dateline.” “How do you explain it?”
“Apparently,” Harpootlian said of his client, “he didn’t do it.”