previously published in the Fall/Winter 2023 issue of Dakota Digital published by the North Dakota University System https://dda.ndus.edu/ddreview/
By ARICA KULM, PHD Director of Digital Forensics Services
Two days before Christmas in 2015, Richard Dabate called 911 to report that his home had been broken into and his wife shot. When the police arrived, they found Dabate on the floor of the home’s main level, partially bound to a folding chair with zip ties. His wife was in the far corner of the basement lying dead, with bullet wounds to the stomach and head. The story that would unfold is one of a marriage that was very different on the inside than how it appeared on the outside.i
Richard and Connie Dabate were married on July 4, 2003. The couple settled in Ellington, Connecticut, and had two sons, Richard (“RJ”) and Connor, who were 9 and 6 years of age in 2015. Richard, aged 40, was a computer technician and Connie, aged 39, worked as a pharmaceutical sales representative for Reckitt Benckiser and was the family’s main “breadwinner.” The Dabate family lived at 7 Birchview Drive, a four-bedroom, colonial-style home at the end of a long driveway in an affluent neighborhood.
Friends describe a happy couple living a seemingly idyllic life with the normal marital spats involving disagreements over money. The digital timeline discovered by investigators leading up to and following Connie’s murder would tell a much different story.
On the morning of December 23, 2015, the Dabates’ sons went to school, and Richard said he left for work between 8:30 and 8:40 a.m., only to realize around five minutes into his trip that he’d forgotten his laptop at home. After pulling over to send a quick email from his phone to his boss to let him know he’d be late, he turned around and headed back home. Upon arrival, which according to Richard was between 8:45 and 9:00 a.m., he heard a noise upstairs and found a man in camouflage and a mask, with a voice like Vin Diesel, rummaging through his wife’s jewelry in a closet. The intruder made demands including money and credit cards with pin numbers, which Dabate said he handed over, even though the intruder didn’t bring a weapon with him.
When Richard heard the garage door and then the kitchen door open, he assumed his wife had returned home early from her exercise class at the Indian Valley YMCA in Ellington. He yelled for her to run, but rather than escaping the house, she ran to the basement. The intruder, Richard claimed, followed Connie there, struggled with her and then shot her in the back of the head and in the stomach with a gun Richard had purchased two months before, but it had never been fired. The gun, a Ruger .357 Magnum revolver, was found to have no fingerprints—not from the intruder, Connie or even Richard. How the intruder supposedly got possession of the gun was never clarified as Richard’s explanation changed several times.
Richard was then stabbed in the legs with a box cutter, which the intruder also found in the house, and then he tied Richard to a chair with zip ties. The intruder began burning Richard with a blowtorch, but when a struggle ensued, Richard managed to burn the intruder’s face before he ran off.
During the initial on-site investigation, police used dogs to try to pick up the scent of the intruder, but they failed to pick up an exit trail of any intruder. The first dog kept circling back to Richard and once tried to jump into the back of the ambulance where Richard was being treated for his injuries. Two additional police dogs failed to pick up any scent of an intruder leaving the property.ii
Many parts of Richard’s story didn’t make sense from the beginning. There were no signs of forced entry into the home, nothing was taken, and none of the neighbors saw anyone suspicious in the neighborhood. Richard claimed to have struggled with the intruder during the invasion but the closet where the struggle was supposed to have taken place was found to be neat and tidy, drawers closed and undisturbed. The intruder was allegedly rummaging through jewelry when Richard encountered him, however the jewelry was still in the closed drawers in the closet. Richard also had no bruises on him despite claiming he had wrestled with the intruder and claiming that the intruder had used “pressure points” to subdue him and tie him to the chair.iii All weapons used by the intruder during the attack originated inside the residence. There were also no signs of a struggle on Connie’s body.
The Other Woman
Investigators would uncover a story worthy of a soap opera from Richard about another woman. She was a high school friend with whom he had begun having an affair in 2014 after she divorced her husband. Richard claimed that he and Connie wanted another child but were unable, so his friend was going to serve as a surrogate, and then the three of them would raise the baby together. After discussing artificial insemination, they decided to go the more traditional route and achieved a pregnancy. Later, he would reveal that his wife did not know about the affair or the pregnancy, which he then said was unplanned.
Digital Evidence
Investigators used multiple items of digital evidence, detailed below, to piece together a timeline showing that Richard was lying about many things. Put together, the digital evidence told a tale of deception, marital strife and ultimately murder.
> Cellphone Evidence
Richard gave written consent to allow the search of his iPhone. Connie’s iPhone was located in the right-side waistband of her sweatpants, under her jacket facing the floor, and was seized at the crime scene.
Recovering data from a cellphone is not always easy during investigations: The make and model of phone, version of installed operating system, condition of the device, and whether it is locked with a passcode or PIN code, all determine whether data can be recovered. Even with a search warrant, suspects are not compelled to reveal their passcodes, and in the case of a deceased victim, his or her passcode might not be known to those left behind.
In this case, however, investigators were able to recover the data from Richard’s and Connie’s cellphones, revealing several incriminating items of evidence.
A year prior to her murder, in December 2014, Connie made two entries in her iPhone Notes application, entitled “Why I Want a Divorce,” detailing the reasons she wanted to divorce her husband. These reasons included the irresponsible way Richard handled money, such as taking funds from accounts that didn’t belong to him, for being an unfit parent, for his uncaring attitude toward her, for not coming home on time and that he “acts like a kid constantly.” She also had a list in the same Notes app of good things about him, which was much shorter. Connie’s cellphone also revealed a text argument between her and Richard the day prior to the murder, in which she accused him of lying about a cable bill.
Richard’s iPhone also revealed important information, including a text to his girlfriend two days prior to the murder promising to divorce his wife. As well, there were several alarm notification text messages during the morning hours indicating the arming and disarming of the home alarm system.
> Camera Evidence
The data from video surveillance cameras at the YMCA where Connie went for exercise classes was analyzed during the investigation. Video surveillance equipment can be of many different makes and models and store data in different ways. Some have internal hard drives in a main unit that store the videos captured by the attached cameras, others have individual memory cards within each camera, and some send the data to cloud storage. It’s important on any system to verify the date and time setting on the camera. Often video surveillance cameras are set up and forgotten. Then power outages or daylight savings time changes, as examples, can cause the date and time to be different from the actual date and time. In this case, the date and time on the YMCA video surveillance cameras were accurate. Cameras from the parking lot showed Connie arriving at about 8:53 a.m. She soon found out that her class was canceled and was seen on the cameras leaving at approximately 9:08 a.m.
> Social Media Data
Social media data is often analyzed during investigations to build a pattern of behavior and relationships. Connie’s Facebook records, as well as those of Richard’s girlfriend, were analyzed.
Connie sent a private message from her cellphone via Facebook Messenger at 8:58 a.m. to a psychotherapist requesting an appointment to be hypnotized “because there’s a lot going on right now.” (Altimari, 2017)
From 9:40 to 9:46 a.m., Connie posted two videos on Facebook using her iPhone and then posted a message to a friend, again through Facebook Messenger. The Internet Protocol (IP) address used to access Connie’s Facebook account was assigned to the couple’s house. Nothing in Connie’s Facebook data, either publicly posted or in her private messages, indicates a divorce pending, or that she had knowledge of Richard’s extramarital affair or the pregnancy.
The analysis of Richard’s girlfriend’s Facebook records further told the story of their relationship, as she confided in friends via Facebook Messenger about her love for him and his promises to divorce his wife. Information from a divorce attorney interviewed during the investigation revealed that Richard had met with him on June 30, 2015, but the attorney was not retained.
> Computer Evidence
Modern computers can also present challenges to investigators, similar to cellphones. Proper forensic technique, when examining a hard drive, requires investigators to create a forensic copy of the hard drive, verify that it matches the original with hashing,iv and then perform the analysis from the copy, leaving the original evidence unchanged. Many computers now come with encryption enabled by default. If a drive is encrypted, a copy of that drive can still be made. However, if it is encrypted and the computer’s password is unknown, all you have is a copy of a hard drive that is also encrypted, and the data cannot be read without the proper decryption code or key. In addition, many modern computers and tablets do not have a removable hard drive, making it less straightforward when obtaining a forensic copy.
In this case, Richard’s Microsoft Surface Pro tablet was able to be examined and revealed items of interest in his web-search history, including visits to websites during the time he alleged he was driving to work on the morning of December 23. At 8:26 a.m. and again at 8:27 a.m., there were visits to Facebook.com. At 8:37 a.m., there was a Google search for “long-lasting tattoo ideas.” At 8:41 a.m., a login to Richard’s Outlook email account was made from the tablet using the IP address from within the home. There were also several visits to other sites, including the Indian Valley YMCA at 9:18 a.m. to download a “Group Exercise Schedule.” Two minutes later, he searched the ESPN website for the “Mike and Mike” show, which was the last time he used his computer that morning.
> Microsoft Corporation Records
Account access, such as those from Microsoft or other online providers, can aid in tying a login event and sometimes a device to a location. Connections to the internet, such as that in the Dabate home, are assigned an IP address, which is a number that uniquely identifies that connection to the Internet Service Provider. Service providers such as Microsoft, which provide products including email, Cloud storage and conferencing apps, have logs of when users connect to their products and from which IP addresses. Richard’s Microsoft account records were analyzed and showed that he accessed his account several times that morning from his home IP address. In this case, the records did not indicate which specific device accessed the records, but the logins located in the Microsoft logs correspond with activity found on either his cellphone or laptop computer. Records indicate an email was sent from Richard’s Outlook email address to his supervisor at 9:04 a.m. Richard said he sent this email while in his car after pulling over almost two miles from the home. The typical reach for a home internet router is only 300 feet outdoors with no obstructions. Richard could not have sent the email from his car as claimed.v
| Fitbit Murder: Timeline of Events July 4, 2003 Richard and Connie Dabate were married. December 2014 Connie made entries on iPhone Notes app on reasons to divorce. June 30, 2015 Richard met with a divorce attorney. DECEMBER 23, 2015: THE MURDER OF CONNIE DABATE 8:26 & 8:27 AM Visits to Facebook.com from Richard’s computer. 8:30 to 8:40 AM Richard claimed he left for work. 8:37 AM Google search for “long-lasting tattoo ideas” from Richard’s computer. 8:41 AM Login to Outlook.com from Richard’s computer (and several additional visits between 8:41 & 9:20 AM). 8:45 to 9:00 AM Richard claimed he returned home to encounter and struggle with an intruder. Then Connie returned home and was shot by supposedly by the intruder after a brief struggle. 8:46 AM Connie’s Fitbit indicated she likely left for the YMCA. 8:47 AM Richard logged into the home alarm website attempting to disarm the alarm. 8:50 AM Richard successfully disarmed the alarm system, then armed it again from the home alarm website. 8:59 AM Richard disarmed the home alarm system from his keychain fob. 8:53 AM Connie arrived at the YMCA (camera evidence). 8:58 AM Connie sent Facebook private message to her psychotherapist. 9:04 AM An email is sent from Richard’s Outlook email account to his supervisor at work. He later claimed he sent it when he pulled over in his car, but the email was sent from his home IP address. 9:08 AM Connie departed from the YMCA (camera evidence and Fitbit inactivity consistent with driving). 9:18 AM Visit from Richard’s computer to the Indian Valley YMCA website. 9:20 AM Visit from Richard’s computer to ESPN’s “Mike and Mike” show website. 9:23 AM Connie’s Fitbit registered activity when the home’s garage door opened (alarm data). 9:40 to 9:46 AM Connie posted two videos to Facebook. 10:05 AM Connie’s last movements registered on Fitbit. 10:12 AM The panic alarm for the home security system was activated from Richard’s keychain fob. |
> Fitbit Evidence
Connie was wearing a Fitbit One activity tracking device, which is designed to be worn clipped to a waistband (as it was on Connie) or other article of clothing, rather than directly contacting the skin. According to the Fitbit website, the data tracked by this model includes steps taken, floors climbed, recent activity levels, distance traveled and calories burned. The data resets at midnight, depending on the time zone selected, with the data being displayed in a user dashboard when it is synced.
Connie’s Fitbit indicated she likely left for her YMCA fitness class around 8:46 a.m. There was a period of inactivity consistent with her driving there, and then activity consistent with her actions while at the YMCA. The next period of inactivity began at 9:08 a.m., the time she was recorded leaving the YMCA. The next recorded movement on Connie’s Fitbit was at 9:23 a.m., the same time as the alarm system registered that a door between the garage and the kitchen was opened. The Fitbit records showed that her last movements inside the home were at 10:05 a.m.—nearly an hour after Richard told detectives she had been killed by the masked intruder.
Richard’s story was that Connie had come into the house and ran directly to the basement after encountering the intruder. However, during the time Richard alleged this occurred, the Fitbit recorded Connie walking a distance of 1,217 feet. This was much further than the approximately 125 feet between her car and the basement, conflicting Richard’s account of Connie’s return home.vi
> Home Alarm Evidence
At 10:12 a.m., the panic alarm for the security system was activated from Richard’s keychain fob. It was the only time the panic alarm went off that morning. Richard had claimed when he turned around to go home to retrieve his laptop, he received alerts about the alarm and emailed his boss that he was returning home to check on it. Richard’s cellphone text messages showed that these various notifications, which included the arming and disarming of the system, were received that morning.
The data recovered from the home alarm system indicated it was armed and disarmed several times that morning. Experts testified about how the system was functioning properly and about the various features of the alarm system, including two keychain fobs that had a maximum range of 500 feet, which would be shortened if any objects were between the fob and the alarm system, or if cellular interference were to intervene. The key fobs were listed as “Keychain” and “KEYFOB6.” KEYFOB6 was on the same keyring as Richard’s Nissan vehicle key fob.
The system also contained motion sensors designed to detect body heat. The alarm company’s records show movement around the house that is inconsistent with Richard’s account of the events. The alarm system was armed as “stay,” indicating people can be in the house and not trigger the alarm, at 8:47 a.m., when Connie was at the gym and Richard claimed to be on his way to work. The alarm system was armed as stay from the keychain fob on Richard’s keychain, which would have required someone to be at the house. At that same time, 8:47 a.m., Richard also logged into the website of the alarm system from his phone to attempt to disarm the system, which was unsuccessful.
Later, at 8:50 a.m., Richard was successful in disarming the system from the website using his phone. Then also at 8:50 a.m., less than a minute later, he armed the system from the website. At 8:59 a.m., the system was disarmed from Richard’s keychain fob. All of this took place during a time that Richard stated he wasn’t at home but rather on his way to check the alarm notifications and to retrieve his forgotten laptop. In addition, the first door to open and close after the system was disarmed at 8:59 a.m. wasn’t an outside entrance, as one would think for a person returning home to retrieve a lost item as he claimed. Rather, the basement door opened and closed indicating whoever opened and closed the door had to already be inside the house. At 9:23 a.m., the opening of the garage door coincided with the data recovered from Connie’s Fitbit activity at the same time, indicating she arrived home from the YMCA.
Also noted was that Richard cancelled his subscription with the alarm company 12 days after his wife’s murder, despite claiming that the home broken into resulted in Connie’s demise.
> Verizon Cellphone Evidence
Records returned from cellular carriers typically include data, such as subscriber information, call records and text message records. Verizon cellphone records for Richard’s girlfriend were seized, and they showed that the text messages between her and Richard were exchanged with Richard using a Google Voice number rather than his primary cellphone number—a fact he failed to disclose during his interview with investigators. Those messages were not stored within the messages associated with Richard’s primary cellphone number so were not recovered from the search of Richard’s cell phone. Had the girlfriend’s cellphone records not been obtained and only the messages from Richard’s cellphone analyzed, the texts between Richard and his girlfriend may not have been located. This highlights the importance of gathering multiple sources of digital evidence.
Richard’s Verizon cellphone records were also obtained. These showed text messages and the notifications received from the alarm company.
Trial & Conviction
The murder of Connie Dabate became known as the “Fitbit Murder,” due to the use of the Fitbit data in helping to solve the crime. However, there were multiple items of digital and other evidence pieced together by investigators to aid in Richard’s arrest and ultimate conviction for his wife’s murder. The 22-day trial began on April 5, 2022, in Rockville Superior Court, and included 600 exhibits and 130 witnesses. The trial was interrupted by the COVID-19 pandemic after the first jury selection was almost complete in March 2020. Then Richard’s attorney died in June 2021. The jury selection resumed in February 2022 with a new jury selection due to the amount of time that had passed, with some of those selected having moved away in the intervening months, in some cases out of state.vii
On May 10, 2022, Richard was found guilty of the murder of his wife, tampering with evidence and making false statements. Prosecutors in the case asked for a 60-year sentence, which was surpassed by the judge after hearing from Connie’s family and friends. It took nearly seven years for her murder to be resolved and justice to be served, but in the end, Richard Dabate was sentenced to 65 years. Currently, he resides in the MacDougall-Walker Correctional Institution in Suffield, Connecticut.viii ◙
References
i Note that much of the information in this article is taken from (Arrest Warrant Application, 2017).
ii Zymaris, E. (2922). “Troopers Detail How K9s Led to Richard Dabate as Murder Suspect.” Retreived from News 8 wtnh.com: https://www.wtnh.com/ news/connecticut/tolland/troopers-detail-how-k9s-led-to-richard-dabate-as- murder-suspect/
iii Altimari, D. (2017, 04 23). “A Marriage Marked by Secrets, A Murder Case Months in the Making.” Retrieved from Hartford Courant: https://www.courant.com/2017/04/23/a-marriage-marked-by-secrets-a-murder-case-months- in-the-making/
iv Hashing is explained in Arica Kulm’s previous article in Dakota Digital Review, “Solving Crime Through Digital Evidence,” available at: https://dda.ndus.edu/ddreview/solving-crime-through-digital-evidence/
v Mitchell B. (2020, November 5). “What Is the Range of a Typical Wi-Fi Network?” from Lifewire: https://www.lifewire.com/range-of-typical-wifi-network-816564
vi H-11 Digital Forensics. (2017, 09 14). “Fitbit Used as Key Evidence in Murder Case.” Retrieved from H-11 Digital Forensics: https://h11dfs.com/fitbit- data-used-as-evidence-in-murder-case/
vii Leavenworth, Jesse. (2022, 02, 28) “Jury Selection in Connecticut ‘Fitbit’ Murder Trial to Begin—Again.” Retrieved from Hartford Courant: https://www. courant.com/2022/02/28/jury-selection-in-connecticut-fitbit-murder-trial-to- begin-again/
viii Connecticut State Division of Criminal Justice. (2022, 08 18). Retrieved from Connecticut’s Official State Website: https://portal.ct.gov/DCJ/Press- Room/Press-Releases/08182022DabateSentencing