Taking An Inside Look At FBI’s Forensic Work In Daybell Case

SALT LAKE CITY, Utah – The FBI Computer Forensics Lab in Salt Lake City opened its doors to give KSL an inside look at the work they do to solve some of the toughest cases in the Intermountain West.

Some FBI agents and forensics experts recently testified in Chad Daybell’s preliminary hearing.

The lab is one of 17 strategically placed across the country, where digital evidence such as computers, cell phones and hard drives are sent for analysis.

Forensic examiners at the lab have worked on some very high-profile cases, like those of McKenzie Lueck, Lauren McCluskey and Lori Vallow and Daybell.

“Digital forensics has been around since the ‘90s and it has only gotten more and more important because everyone owns a computer or a phone. No matter what kind of crime occurs, there is going to be digital media involved,” said Cheney Eng-Tow, special agent and director of the Intermountain West Regional Computer Forensics Lab. “A lot of the cases that you see in the news or read about end up here.”

The Intermountain West Regional Computer Forensics Lab is sponsored by the FBI and works with local law enforcement agencies in Utah, Idaho and Montana.

Local government agencies that contribute personnel and resources to staff and maintain the operation of the IWRCFL include the Sandy Police Department, Salt Lake City Police Department, Ada County (Idaho) Sheriff’s Office, Billings (Montana) Police Department, Davis County Sheriff’s Office, Boise City Police Department (ID), the Utah Department of Public Safety and the Utah Attorney General’s Office.

Eng-Tow said the services they provide are cost-free. The services are crucial to smaller law enforcement agencies and those with limited resources by giving them access to cutting edge technology and trained personnel.

Eng-Tow could not provide specifics on Daybell’s case because it is still active. But he said they received multiple items for examination.

However, one of the lab’s forensic examiners, Gary Lyu, testified during Daybell’s preliminary hearing on Aug. 4.

Daybell is facing four felony charges, including conspiracy to commit destruction, alteration or concealment of evidence and destruction, alteration or concealment of evidence after the remains of 7-year-old JJ Vallow and 16-year-old Tylee Ryan were found buried in his backyard.

Lyu testified that on Jan. 15, the Fremont County Sheriff’s Office dropped off what was later determined to be Tammy Daybell’s cell phone for forensic examination.

The cell phone, described as an LG model, was seized during the execution of a search warrant at Chad Daybell’s home in January, where 43 items were reportedly seized.

According to Lyu, the cell phone was sent to FBI headquarters, where the password was deciphered, along with data including text messages, emails and pictures.

Lyu explained that the process is very meticulous, and a chain of custody report is created for each item of evidence once it arrives at the IWRCFL in Salt Lake City to maintain the integrity of the evidence.

During the Aug. 4 hearing, Lyu testified that the cell phone stood out from other items checked in as evidence because of its case.

“The phone cover is a clear rubber outer case with purple glitters in it. It has hearts in there too,” said Lyu.

Lyu said the phone was mailed back to the lab from FBI headquarters in March and he took custody of it on March 12. He also received a 16 GB SD card containing extracted data from the phone. Lyu confirmed the phone and data’s integrity remained intact by confirming the hash value.

According to Lyu, a hash value is like a fingerprint for data. Any small changes, like a comma, would alter the hash value and show the data has been contaminated.

Digital information from evidence is duplicated providing forensic scientists with a workable copy. The workable copy is verified as a replica of the original evidence by comparing each item’s hash value.

“If the hash value matches, it means the data was not tampered with or modified in any shape or form,” Lyu said.

Lyu said he then parsed the data, meaning he converted it into “human-readable form,” and turned it turned over for FBI intelligence analyst Benjamin Dean to review.

On Aug. 4, Dean also testified that a message between Chad Daybell and Tammy Daybell stood out to him from the morning of Sept. 9, 2019. This was the morning after the last known sighting of Ryan at Yellowstone National Park.

“Upon reading this text message in which Chad appears to claim to have shot [a raccoon] or started a fire […] and buried it on his property I recognized it was sent a day after Tylee was last seen alive and I became concerned,” said Dean during Daybell’s hearing.

The text message exchange read as follows:

Sept. 9, 2019, at 11:53:27 from Chad to Tammy: “I’ve had an interesting morning! I felt I should burn all of the limb debris by the fire pit before it got too soaked by the coming storms.

“While I did so, I spotted a big racoon along the fence.

“I hurried and got my gun, and he was till walking along. I got close enough that one shot did the trick.

“He is now in our pet cemetery. Fun times!” Chad Daybell said.

11:56:59 a.m. from Chad to Tammy: “Gonna shower now and go write for a while at BYU. Love you.”

2:47:06 p.m. from Tammy to Chad: “Good for you.”

2:48:29 p.m. from Chad to Tammy: “I’m back home now.”

The information was later used to help detectives secure a search warrant of Chad Daybell’s backyard in early June. It was in two key locations that they found the remains of JJ Vallow and Ryan.

“We’re going to find whatever information is on there and if we can play a role in helping put people in jail and get punished because they committed criminal acts, we are all for that,” Eng-Tow said.

Another important work that goes on at the Lab are cases related to child pornography. Eng-Tow said about half of the cases that they work are related to child pornography, sexual assault or sexual exploitation cases.

“Nobody wants to sit and look at child pornography, but our examiners have to do that with the greater goal in mind that in the end, hopefully we will make a difference and help put these guys in jail.” Eng Tow said.

To learn more about the lab click here.

See KSL-TV’s full coverage of the case here.