The bomb that killed Daphne Caruana Galizia on 16 October 2017 was active at 1.41am, more than 12 hours before the journalist was killed at around 3pm on the same day, a court heard on Thursday.

FBI Agent Richard Fennern was testifying in the trial by jury against four men accused of murdering Daphne Caruana Galizia and Carmel Chircop.

The four men accused are Robert and Adrian Agius, known as the Maksar brothers, Jamie Vella and George Degiorgio.

Vella and Robert Agius are accused of complicity in the murder of journalist Daphne Caruana Galizia by supplying the bomb that killed the journalist in October 2017. Adrian Agius is charged with commissioning the murder of lawyer Carmel Chircop in 2015. Prosecutors insist that the hit was also carried out in complicity with  Jamie Vella and George Degiorgio who are accused of executing Chircop's murder. 

Testifying in court, the agent described the movements of devices that were used to trigger the blast.

The phone records allowed investigators to find out that the bomb was active as early as 1:41am on the day of the murder, he said. 

We had the two phones identified for the detonation, and three phones whose only communication is with each other. "Consistent with phones used for a specific purpose, Fennern testified.

Based on a review of records, investigators were able to find other mobile numbers associated with the explosive and the detonator numbers. They found three mobile phones that were bought at around the same time, and investigated these further. Records showed that there was a lot of communication between the numbers on the day of the murder, and mobile devices associated with two of the numbers identified were found to be in close proximity to Caruana Galizia's house on the day. 

According to the investigator, the killer device was first used on 10 January. The SIM card belonging to the phone that was used in the bomb received a top-up text and a confirmation text. Another SIM card was then placed into the same device, while the original card was placed in what would end up being the mobile that would send the killer text from out at sea.

The agent explained that one device was abruptly disconnected from the network at the time of the murder. It received a text message at 2:58pm, and the position of the text message was consistent with the area of the explosion.

The text message was decoded and it showed that the mobile phone number 99684366 sent a text message to 99683752 at 2.58pm and that message was "#REL1=ON".

Agent Fennern said they concluded that the numbers 99684366 and 99683752 were those utilised to detonate the device. One was the telephone that sent the text message and the receiving number was a GSM module.

The mobile's position was consistent with being at sea, whilst the GSM module was in Bidnija.

Fennern explained tower activity in the Bidnija area between 2:58pm and 3:02pm, which is roughly when the bomb went off. There were 53 different cell phones being used at that time. From that, they went back to the phone company and asked which phones were still on the network. "The logic is that if a device was never used again, it might have been the one that was used to detonate the bomb," he explained.

After looking at records for that phone, investigators found that the only activations with the phone network were on 10 January, 21 August, and 16 October (the day of the murder).

Summarising findings, the investigator read out in court the numbers that were connected to the bombs or the accomplices in the murder:

• Number 99683752 was connected to the bomb device and acted as a detonator. Based on the text message content, 99684366 sent the message to detonate the device.
• The mobile 99088820 acted as a lookout in Bidnija. He called 99088824 in order to execute the detonation.
• Based on a review of records, it is believed that number 99088820, 99088824 and 99088823 worked together to execute the placement and detonation of the device.
• Numbers 99684366 and 99088824 were co-located in the same areas on 16 October.
• Based on the review of tower dump information for number 99684366 on the 16 October it is believed that number 99623741 subscribed to George Degiorgio was also co-located to the numbers 99684366 and 99088824.
• Based on review of records, telephone number 99328493 believed to be used by Alfred Degiorgio and number 99088820 were co-located throughout the usage period of number 99088820.

William Shute, another investigator, said they were asked by FBI HQ to travel to Germany to give a presentation for German law enforcement. At the same time, there was an opportunity to come to Malta to present law enforcement techniques. While in Germany, they learned of Caruana Galizia's murder. They were asked to come to Malta, but instead of giving a presentation, they hjelped Maltese police with the investigation, especially with cell phone analysis.

The two had already testified during the compilation of evidence against George Degiorgio, Alfred Degiorgio and Vincent Muscat.