(1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) e Menu °o Overview © Device Details =» NYC024328 aff4 (Evidence ID: NYC024328.aff4 - 001) © Case Data = Calendar Items Calls Contacts Messages Top Contacts User Accounts Case Data: Calls (1201-1300 of 1416) Service Direction Type Date iPhone Incoming Phone ay ea12 (UTC) iPhone Outgoing Phone pas (ore) iPhone Incoming Phone 01:37:53 (UTC) FaceTime Outgoing Video loo, 1 oe (UTC) FaceTime Outgoing Video 10.25.18 (UTC) FaceTime Outgoing Video ingoa7 (UTE) iPhone Incoming Phone iaa7 dre} iPhone Outgoing Phone reef 1 27 (UTC) iPhone Outgoing Phone paaas ture) iPhone Outgoing Phone 12:56:82 (TC) iPhone Outgoing Phone 12:58:01 (UTC) iPhone Outgoing Phone 13.09.10 (UTC) iPhone Outgoing Phone 13-0621 (UTC) iPhone Incoming Phone 1307-01 (TC) iPhone Incoming Phone 5.99.9 (UTC) iPhone — Outgoing Phone re i 5:41 (UTC) Duration (HH:MM:SS) Contacts <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:00:07 00:01:11 00:00:00 00:00:00 00:00:00 Unknown 00:00:00 <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:00:00 00:01:00 Unknown 00:03:57 <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:00:03 00:01:46 00:04:49 00:00:41 00:08:31 00:00:09 00:00:41 Status Missed Cancelled Cancelled Cancelled Missed EFTA00506525

--=PAGE_BREAK=--

(1) (1) (1) (1) (1) (1] [2] (1) [2] (1) (1) (1) (1) (1] (1) (1) (1) (1) (1) (1) (1) (1] (1) (1) (1) (1) 2019-06-03 iPhone Incoming Phone } 3.18.49 (UTC) iPhone Incoming Phone +141 \9¢ (UTC) iPhone Incoming Phone 14:5423 (UTC) iPhone Incoming Phone 15 601 (UTC) FaceTime Outgoing Video Trt (UTC) FaceTime Outgoing Video sao tne) FaceTime Outgoing Video 9-060 (TC) FaceTime Outgoing Video 18.09.42 (UTC) iPhone Incoming Phone 92928 (UTC) iPhone Outgoing Phone 30s6:57 ITC) iPhone — Outgoing Phone 2047517 (UTC) iPhone Outgoing Phone 39 148°91 (UTC) iPhone — Outgoing Phone 20:49:04 (UTC) iPhone Outgoing Phone 20.89.50 (UTC) iPhone Outgoing Phone 30.5 1 2 (ITC) iPhone Outgoing Phone 20:53:88 (UTC) iPhone Outgoing Phone on-55:18 (Te) iPhone Outgoing Phone aL: S02 (UTC) iPhone Incoming Phone 21:46:30 (UTC) iPhone Outgoing Phone 158.16 (UTC) iPhone Outgoing Phone os 11:52 (UTC) iPhone Outgoing Phone 22:94:57 (UTC) iPhone Incoming Phone 22:33:28 (UTC) iPhone Incoming Phone isso 12:15:39 (UTC) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:02:05 00:00:40 Unknown ( Unknown ) 00:01:03 <Encrypted Blob> ( <Encr ypted Blob> ) 00:06:18 Unknown 00:08:38 <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:08:38 00:07:09 00:07:09 00:01:16 00:00:00 00:00:00 00:00:00 00:00:00 Unknown 00:00:00 <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Ener ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:00:00 00:01:02 00:15:12 00:00:02 00:00:00 00:12:55 00:00:02 00:07:45 Unknown 00:02:18 <Encrypted Blob> ( <Encr ypted Blob> ) 00:00:00 Cancelled Cancelled Cancelled Cancelled Cancelled Cancelled Missed Missed EFTA00506526

--=PAGE_BREAK=--

(1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1] (1) (1) (1) (1) (1) (1) (1) (1] (1) (1) (1) (1) 2019-06-04 iPhone Outgoing Phone } 491-11 (UTC) iPhone Incoming Phone Is 2stones iPhone — Incoming Phone 15:52:29 (UTC) iPhone Outgoing Phone 10714 (OTC) iPhone Outgoing Phone Te i 9:16 (UTC) iPhone Outgoing Phone 162006 (UTC) iPhone — Outgoing Phone 16:32:50 (UTC) FaceTime Outgoing Video 1647360010) iPhone Outgoing Phone 16:48:53 (UTC) FaceTime Outgoing Video 17:33:04 (UTC) FaceTime Outgoing Video 174340 (TC) iPhone Incoming Phone i9a7s4(urC} iPhone Incoming Phone 1935/04 (010) iPhone Incoming Phone 1913543 (UTC) iPhone Incoming Phone 39'24\9¢ (UTC) iPhone Incoming Phone meses (UTC) iPhone Outgoing Phone IDs 1 27 (UTC) iPhone Outgoing Phone oe 148 (U0) iPhone Incoming Phone 12:59:09 (UTC) iPhone Outgoing Phone 14:02:55 (UTC) iPhone Outgoing Phone 10ase anc) iPhone Outgoing Phone 14:04:15 (UTC) iPhone Outgoing Phone 1'494:4% (UTC) iPhone Outgoing Phone lostott 14:05:12 (UTC) <Encrypted Blob> (<Encr ,, 1. ypted Blob> ) 00:00:07 Unknown ( Unknown ) 00:00:00 Unknown ( Unknown ) 00:00:00 <Encrypted Blob> (<Encr ,,. 1. ypted Blob> ) 00:00:02 <Encrypted Blob> (<Encr ,, 1. ypted Blob> ) 00:00:33 <Encrypted Blob> (<Encr ,,,,., ypted Blob> ) 00:10:12 <Encrypted Blob> (<Encr ,, 1. ypted Blob> ) 00:00:33 <Encrypted Blob> ( <Encr ,, 1, ypted Blob> ) 00:09:22 <Encrypted Blob> ( <Encr ,,._,,, ypted Blob> ) 00:00:12 <Encrypted Blob> (<Encr ,, 1. ypted Blob> ) 00:00:00 <Encrypted Blob> (<Encr ,,_,,, ypted Blob> ) 00:01:32 <Encrypted Blob> (<Encr ,, 1. ypted Blob> ) 00:00:36 <Encrypted Blob> (<Encr ,, 1. ypted Blob> ) 00:02:09 Unknown 00:00:00 <Encrypted Blob> ( <Encr ,,._,,., ypted Blob> ) 00:00:00 <Encrypted Blob> (<Encr ,, ... ypted Blob> ) 00:01:56 <Encrypted Blob> ( <Encr ,,._,,, ypted Blob> ) 00:00:00 Unknown 00:00:38 Unknown 00:00:44 <Encrypted Blob> (<Encr ,,. 1. ypted Blob> ) 00:00:00 <Encrypted Blob> (<Encr ,, 1. ypted Blob> ) 00:00:13 <Encrypted Blob> ( <Encr ,,._,,, ypted Blob> ) 00:00:19 <Encrypted Blob> ( <Encr ,,_,,., ypted Blob> ) 00:00:18 <Encrypted Blob> (<Encr ,, 1. ypted Blob> ) 00:00:24 Missed Missed Cancelled Missed Missed Cancelled Cancelled EFTA00506527

--=PAGE_BREAK=--

(1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1] (1) (1) (1) (1) (1) (1) (1) (1] (1) (1) (1) (1) 2019-06-05 iPhone Outgoing Phone } 4 95.44 (UTC) iPhone Outgoing Phone 14.0608 0710) iPhone Incoming Phone 14.98:58 (UTC) iPhone Incoming Phone 115.97 (UTC) iPhone Incoming Phone 38 55°41 (UTC) iPhone Outgoing Phone 18 47111 (UTC) iPhone Outgoing Phone 19.48.99 (UTC) iPhone Outgoing Phone 19:53:38 (UTC) iPhone Outgoing Phone 5-50.19 (ne) iPhone Incoming Phone 30.01.03 (UTC) iPhone Outgoing Phone 3), 10:19 (UTC) iPhone Outgoing Phone 31 13:59 (UTC) iPhone Incoming Phone 99.94.41 (UTC) iPhone Outgoing Phone 93.49.95 (UTC) iPhone Outgoing Phone 00:29:47 (UTC) FaceTime Incoming Video 7929.06 (UTC) FaceTime Outgoing Video paren ture) FaceTime Outgoing Video 09:47:08 (UTC) FaceTime Incoming Video psgas (UTC) iPhone Incoming Phone 143659 (UTC) iPhone Incoming Phone 145690 CTC) iPhone Incoming Phone 12980 0TC) iPhone Incoming Phone 194687 TC) iPhone Incoming Phone 70180606 15:59:49 (UTC) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:00:19 00:00:30 00:00:00 00:00:00 Unknown (Unknown) —00:00:21 <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:00:19 00:01:07 00:00:35 00:04:32 00:00:00 00:00:00 00:10:49 Unknown 00:00:00 <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr 00:02:16 ypted Blob> ) 00:01:27 Unknown 00:00:00 ie) (<Ener 99).99:00 “Encrypted Blob (<Ener 99.09.00 Missed Missed Missed Cancelled Missed Missed Cancelled Cancelled Missed Missed Missed Missed Missed EFTA00506528

--=PAGE_BREAK=--

(1) (1) (1) (1] (1) (1) (1) (1) (1) (1) (1) (1) [1] Source File [2] iPhone iPhone iPhone iPhone iPhone iPhone iPhone iPhone iPhone iPhone iPhone iPhone 2019-06-06 16:00:46 (UTC) 2019-06-06 16:03:50 (UTC) 2019-06-06 16:11:03 (UTC) 2019-06-06 16:21:46 (UTC) 2019-06-06 16:30:07 (UTC) 2019-06-06 17:34:38 (UTC) 2019-06-06 18:02:25 (UTC) 2019-06-06 18:05:27 (UTC) 2019-06-06 19:14:25 (UTC) 2019-06-06 19:49:52 (UTC) 2019-06-06 19:50:26 (UTC) 2019-06-06 19:51:58 (UTC) Incoming Phone Incoming Phone Incoming Phone Incoming Phone Incoming Phone Incoming Phone Incoming Phone Incoming Phone Outgoing Phone Incoming Phone Outgoing Phone Outgoing Phone Notes [1] Source Device NYC024328.aff4/Macintosh HD /Users/jee/Library/Application Support/CallHistoryDB/CallHistory.storedata Recovered Record <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:00:00 00:00:00 00:00:26 00:00:00 Unknown 00:00:00 <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Ener ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) <Encrypted Blob> ( <Encr ypted Blob> ) 00:00:00 00:00:00 00:00:00 00:03:10 00:00:02 00:00:00 00:00:00 Case Data: Calls (1101-1200 of 1416) Case Data: Calls (1301-1400 of 1416) Missed Missed Missed Missed Missed Missed Missed Cancelled Cancelled EFTA00506529