Why the code that broke open the Alex Murdaugh murder case took months to crack

A key piece of evidence in the murder trial of Alex Murdaugh was a cellphone video that captured his voice at the dog kennels on his family’s sprawling Lowcountry estate — the place where his wife, Margaret, and son Paul were found fatally shot on June 7, 2021.

The disgraced South Carolina lawyer had told authorities that he wasn’t there the night of the killings. But the video — taken by Paul and stored on his phone — showed that he was.

It took investigators months to recover the video — even though the six-digit passcode to the locked device was as basic as it gets: 041499, Paul’s birthday. 

For more on the case, tune into “The Murdaugh Murders: Inside the Investigation” on “Dateline” at 9 ET/8 CT tonight.

In his first interview about the case, the South Carolina investigator charged with cracking the phone told NBC News’ “Dateline” why the process took so frustratingly long, how law enforcement finally gained access to it, and how astonished authorities were when they discovered the video.

“I was in disbelief,” Lt. Britt Dove, a computer crimes investigator for the state Law Enforcement Division. “I hollered out that I found it to nobody in particular ’cause I was in the office working by myself.”

Murdaugh, who has proclaimed his innocence in the killings of Margaret, 52, and Paul, 22, has acknowledged lying to authorities about his alibi on the night of the murders. 

During his trial, Murdaugh, 55, blamed the deception on his addiction to pain pills and paranoia. He was convicted in March and sentenced to life in prison without parole.

Lawyers for Murdaugh have appealed the conviction, alleging in court documents filed in September that a county official tampered with the jury. An appeals court agreed to allow Murdaugh, who pleaded guilty Friday in a separate financial crimes case, to ask for a new trial.

Dove said he got Paul’s iPhone on Aug. 13, 2021, nine and a half weeks after the slayings. Investigators already knew that accessing it would be critical: The night of the killings, Alex told the case’s lead detective, David Owen, a senior special agent with the South Carolina Law Enforcement Division, that he hadn’t been to the kennels. 

Murdaugh told Owen that he’d stayed at a house on the property and that after dinner, he’d taken a nap while his wife went to the kennels, Owen told “Dateline” in his first interview on the case. 

At 10:07 p.m., Alex dialed 911 and said that he’d found the bodies of his wife and son.

But within 24 hours, Owen said, a Murdaugh family friend had provided investigators with details challenging that account. Paul was caring for the friend’s dog — a chocolate lab named Cash — and he called the friend on the night of the killings to talk through an issue he was having with Cash.

The friend, Rogan Gibson, told investigators that while talking with Paul, he was nearly certain that he heard Alex in the background, Owen said. Gibson mentioned something else: Paul had tried to send him a video of the dog but couldn’t because of spotty cell coverage, Owen said.

The passcode problem

After the killings, authorities obtained Paul’s iPhone almost immediately, Owen said. But it was locked and authorities didn’t know his passcode.

Apple allows users to enter the wrong passcode only a handful of times before the phone is permanently disabled. To access the device after that, it needs to be reset — a process that would wipe out everything on it, including videos. 

When Dove got the phone, he said it was temporarily disabled, with a message telling him to enter a passcode again in a few minutes. He said he wasn’t sure who had entered the wrong code or how many times they’d done so.

Investigators had supplied Dove with roughly 20 numbers that he described as significant dates associated with Paul, he said. Some were birthdays, Dove said, but none were Paul’s.

Although a date of birth might appear to be an obvious choice for a passcode, Dove said that in his experience — he’s been a computer crimes investigator for 15 years — the codes that people use vary. 

Some select random numbers, Dove said. Others use street numbers or a spouse’s birthday.

“You can’t say the top three will always be a birthday,” he said. “It just changes from person to person.”

Dove tried a couple of combinations from the list, but they didn’t work, he said. And he tried breaking in with a “brute force attack,” or a forensic tool that systematically tries different combinations on a phone until it comes up with the correct one. 

Those tools, which allow investigators to manually sidestep entering a passcode, can take years depending on the code’s complexity, Dove said. In a separate case, Dove recalled, it took authorities two years to break into a phone using a brute force attack.

The technique recovered little on Paul’s phone, and investigators were still unable to search the entire device, Dove said. So he decided to hold off and wait for a technological advance that might help them crack Paul’s passcode. 

“I had to be mindful that if we try these attempts and we failed that we could have potentially lost any information on there,” he said. “And once we lost that information — even six months from now, a year from now, [when] we might have been able to get into it — it does us no good because the information’s gone.”

As the months ticked by and the investigation stalled, Dove said he eventually learned of a company that could likely access the phone, figure out its passcode and process the device. The U.S. Secret Service would assist in the process, Dove said, so he sent the phone to the agency.

But before federal investigators shared the device, Dove said, they decided to make one more attempt to unlock the phone using a passcode that Dove hadn’t tried — Paul’s birthday.

It worked, Dove said, and by late March 2022, he’d retrieved the device and obtained a copy of the video described by Gibson.

The crucial clip

The brief clip, which had a time stamp off 8:44 p.m., contained three distinct voices, Dove said — Paul, who’s shooting the video and grabbing at the dog, Cash; his mother, who can be heard shouting that another dog, Bubba, has a “bird” in its mouth; and a third voice — Alex’s — that was also shouting at Bubba.

Dove said he watched the video once, then turned up the volume and watched it again.

“Then I put headphones on to make sure I was really hearing what I thought I heard,” he said, adding: “This, we knew for a fact then, just destroyed whatever alibi that was put out.”

After watching the video a few times, he called Owen, who recalled thinking that he now had “tangible evidence” that Alex was lying.  

“It put Alex at the kennels when he said he wasn’t there,” Owen said, adding: “I was excited. I was really excited.”

Alex’s lawyers came to have a name for what the video showed — “the lie.”

“How do you get around it?” Dick Harpootlian, one of those lawyers, told “Dateline.” “How do you explain it?”

“Apparently,” Harpootlian said of his client, “he didn’t.”