RevForensics.com October 11, 2017

Transcription

1 October 11, 2017 AT&T Mobility National Court Order Compliance US Highway 1, Suite 600 North Palm Beach, FL (800) Fax (888) Dear Sir or Ma am, I am conducting an investigation and have identified the phone number as likely being pertinent to this case. Per 18 USC 2703, I am requesting AT&T Mobility preserve the records for the phone number , to include the following: 1. Subscriber information for the number including by way of example and not limitation: a. Subscriber Name b. Subscriber Address c. Identifying information such as date of birth, driver s license number, and/or social security number d. Subscriber contact information including addresses and contact phone numbers 2. Billing and credit information for the phone number including by way of example and not limitation: a. Method and source of payment information including credit card numbers, electronic funds transfers, and locations of cash payments b. Credit information including any credit report run by the provider prior to the authorizing service 3. Service information for the phone number including by example and not limitation: a. Purchase and activation location b. Types of service subscribed to c. Additional phone numbers associated with the same account d. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account 4. Call Detail Records for the wireless number for the days of 06/01/2015 to 07/01/2015, Eastern Time, including: a. Cellular calls, b. SMS/MMS messages c. Data communication d. Tower locations (LAC/CID) and azimuth for the sectors accessed during the communication 5. Any data in the AT&T cloud services associated with the wireless number , including by way of example and not limitation a. SMS, MMS, b. s communications 6. Location of the phone with the wireless number using Network Event Location System (NELOS) and Mobile Locator Tool data including reliability factors for the communication for the days of 06/01/2015 to 07/01/2015, Eastern Time. 7. Voice Mail Messages including content

2 8. A detailed definitions page which identifies all information in the records I will follow up with a court order or subpoena as needed. Thank you for your assistance. Sincerely, Benjamin Bierce Revelation Cellular Forensics LLC ben@revforensics.com

3 Notes for Preparing the Legal Demand AT&T maintains records for the following periods o Cell sites for voice, text, and data back to July 2008 o NELOS, about 30 days o They do not store the content of text messages at all AT&T will supply the records with cell tower information from a subpoena, but a court order will result in a quicker turnaround. Be sure to request the records in digital format, specifically in.txt format, on a CD with the preparer s signature on it and a notarized copy of the Affidavit of Custodian of Records. AT&T provides digital records in PDF format by default, but will provide them in.txt format upon request. For analysis, I much prefer the.txt format. Request at least 30 days of records if you can justify it. A month of records is a large enough sample to establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger the sample, the better the analysis. The following is the text I place in the notes of the fax coversheet o This is in reference case number xxx. Please provide the information in.txt format. Please the records to me so I can begin working on them immediately. For court purposes, I need a certified copy as well. Please provide all the records along with the cell site locations in a single disc, and have the custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian of Records and return the original copy with the records. The information may be mailed to: If you are having Revelation Cellular Forensics conduct the analysis you may want to include text like the following: o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these records. I respectfully request you allow Mr. Bierce to contact you directly with any questions concerning these records.

4 February 1, 2019 Sprint Corporation Security & Subpoena Compliance 6480 Sprint Parkway MS: KSOPHM0216 Overland Park, KS (800) Fax (816) Dear Sir or Ma am, I am conducting an investigation and have identified the phone number as likely being pertinent to this case. Per 18 USC 2703, I am requesting Sprint Corporation preserve the records for the phone number , to include the following: 1. Subscriber information (Expanded) for the number including by way of example and not limitation: a. Subscriber Name b. Subscriber Address c. Identifying information such as date of birth, driver s license number, and/or social security number d. Subscriber contact information including addresses and contact phone numbers 2. Billing and credit information (Payment Information) for the phone number including by way of example and not limitation: a. Method and source of payment information including credit card numbers, electronic funds transfers, and locations of cash payments b. Credit information including any credit report run by the provider prior to the authorizing service 3. Service information for the phone number including by example and not limitation: a. Purchase and activation location b. Types of service subscribed to c. Additional phone numbers associated with the same account d. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account

5 4. Call Detail Records for the wireless number for the days of 07/01/2015 to 08/01/2015, Eastern Time, including by example and not limitation: a. Cellular calls (Call Detail Records with Cell Site Location) b. SMS/MMS messages c. Data communication (IPDR w/ Cell Site, Web Site Address Report) d. Tower locations (NEID, Cell Number, Sector Number, enode) and azimuth for the sectors accessed during the communication 5. Voice Mail Messages including content (Stored Voice Mail Reproduction) 6. PCMD (Per Call Measurement Data) for the cellular phone number for the days of 07/01/2015 to 08/01/2015, Eastern Time, to include reliability factors for the communication 7. A detailed definitions page which identifies all information in the records I will follow up with a court order or subpoena as needed. Thank you for your assistance. Sincerely, Benjamin Bierce Revelation Cellular Forensics LLC ben@revforensics.com

6 Notes for Preparing the Legal Demand Sprint maintains records for the following periods o Cell sites for voice only for 18 to 24 months o No cell sites for text messages or data o They do not store the content of text messages at all o PCMD (Per Call Measurement Data) is stored for 14 days Sprint requires a court order to produce the records. Be sure to request the records in digital format on a CD with the preparer s signature on it and a notarized copy of the Affidavit of Custodian of Records. Sprint provides the records in Microsoft Excel format. A spreadsheet containing all the Sprint cell sites is necessary for the analysis, and Sprint is inconsistent about sending them. Follow up contact may be necessary but no additional legal demand would be needed. Request at least 30 days of records if you can justify it. A month of records is a large enough sample to establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger the sample, the better the analysis. The following is the text I place in the notes of the fax coversheet: o This is in reference case number xxx. Please provide the information in digital format, either in Microsoft Excel, or a format that could be exported to Excel. If you provide the information in a format other than Excel please provide instructions to export to excel. Please the records to me so I can begin working on them immediately. For court purposes I need a certified copy as well. Please provide all the records along with the cell site locations in a single disc, and have the custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian of Records and return the original copy with the records. The information may be mailed to: If you are having Bierce Associates conduct the analysis you may want to include text similar to the following: o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these records. I respectfully request you allow Mr. Bierce to contact you directly with any questions concerning these records.

7 October 11, 2017 T-Mobile, USA Law Enforcement Relations 4 Sylvan Parsippany, NJ (973) Fax (973) Dear Sir or Ma am, I am conducting an investigation in a civil case and have identified the phone number as likely being pertinent to this case. Per 18 USC 2703, I am requesting T-Mobile, USA preserve the records for the phone number , to include the following: 8. Subscriber information for the number including by way of example and not limitation: a. Subscriber Name b. Subscriber Address c. Identifying information such as date of birth, driver s license number, and/or social security number d. Subscriber contact information including addresses and contact phone numbers 9. Billing and credit information for the phone number including by way of example and not limitation: a. Method and source of payment information including credit card numbers, electronic funds transfers, and locations of cash payments b. Credit information including any credit report run by the provider prior to the authorizing service 10. Service information for the phone number including by example and not limitation: a. Purchase and activation location b. Types of service subscribed to c. Additional phone numbers associated with the same account d. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account

8 11. Call Detail Records for the wireless number for the days of 1/1/2015 to2/1/2015, Eastern Time, including: a. Cellular calls, b. SMS/MMS messages c. Data communication d. Tower locations (LAC/CID) and azimuth for the sectors accessed during the communication 12. A list of all T-Mobile cell towers with latitude, longitude, address, and sector directions and beam widths 13. Voice Mail Messages and Text Messages including content 14. A detailed definitions page which identifies all information in the records 15. Please provide records in Eastern Time I will follow up with a search warrant as needed. Thank you for your assistance. Sincerely, Benjamin Bierce Revelation Cellular Forensics LLC ben@revforensics.com

9 Notes for Preparing the Legal Demand T-Mobile maintains records for the following periods o Cell sites for voice and text, 2 years o No cell sites for or data o They do not store the content of text messages at all T-Mobile requires a court order to produce the records. Be sure to request the records in digital format on a CD with the preparer s signature on it and a notarized copy of the Affidavit of Custodian of Records. T-Mobile provides the records in Microsoft Excel format. A spreadsheet containing all the T-Mobile cell sites is necessary for the analysis, and T-Mobile is inconsistent about sending them. Follow up contact may be necessary but no additional legal demand would be needed. Request at least 30 days of records if you can justify it. A month of records is a large enough sample to establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger the sample, the better the analysis. The following is the text I place in the notes of the fax coversheet: o This is in reference case number xxx. Please provide the information in digital format, either in Microsoft Excel, or a format that could be exported to Excel. If you provide the information in a format other than Excel please provide instructions to export to excel. Please the records to me so I can begin working on them immediately. For court purposes I need a certified copy as well. Please provide all the records along with the cell site locations in a single disc, and have the custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian of Records and return the original copy with the records. The information may be mailed to: If you are having Bierce Associates conduct the analysis you may want to include text similar to the following: o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these records. I respectfully request you allow Mr. Bierce to contact you directly with any questions concerning these records.

10 August 1, 2015 Verizon Wireless Law Enforcement Resource Team 180 Washington Valley Rd. Bedminster, NJ (800) Fax (888) Dear Sir or Ma am, I am conducting an investigation in a civil case and have identified the phone number as likely being pertinent to this case. Per 18 USC 2703, I am requesting Verizon Wireless preserve the records for the phone number , to include the following: 16. Subscriber information for the number including by way of example and not limitation: a. Subscriber Name b. Subscriber Address c. Identifying information such as date of birth, driver s license number, and/or social security number d. Subscriber contact information including addresses and contact phone numbers 17. Billing and credit information for the phone number including by way of example and not limitation: a. Method and source of payment information including credit card numbers, electronic funds transfers, and locations of cash payments b. Credit information including any credit report run by the provider prior to the authorizing service c. Payment Activity d. Payment History e. Auto Bill Copy 18. Service information for the phone number including by example and not limitation: a. Purchase and activation location b. Activation/Deactivation Dates c. Types of service subscribed to

11 d. Additional phone numbers associated with the same account (Other Numbers on Account) e. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account (Device ID) 19. Call Detail Records for the wireless number for the days of 06/01/2015 to 07/01/2015, Eastern Time including: a. Cellular calls, (Cell-Site Incoming, Outgoing) b. SMS/MMS messages (Historical MMS Detail, Text Message Detail, Auto Text Message Content, Auto Picture Content, Picture content, Auto Picture Detail, Picture Message Detail) c. Data communication (IP Destination, IP Session) d. Tower locations (Switch/Element, Cell Numbers, Sector Numbers) and azimuth for the sectors accessed during the communication 20. Voic Messages including content (Voic Password Reset) 21. RTT (Round Trip Time) for the cellular phone number for the days of 06/01/2015 to 07/01/2015, Eastern Time, to include reliability factors for the communication 22. Any data in the Verizon cloud services associated with the wireless number , including by way of example and not limitation a. SMS, MMS, b. s communications 23. A detailed definitions page which identifies all information in the records I will follow up with a search warrant as needed. Thank you for your assistance. Sincerely, Benjamin Bierce Revelation Cellular Forensics LLC ben@revforensics.com

12 Notes for Preparing the Legal Demand Verizon maintains records for the following periods o Cell sites for voice only for 12 months o No cell sites for text messages or data o They do the content of text messages for 7 days o RTT (Round Trip Time) is stored for 7 days Verizon will honor a subpoena, but a court order will result in a faster return. Be sure to request the records in digital format on a CD with the preparer s signature on it and a notarized copy of the Affidavit of Custodian of Records. Verizon provides the records in Microsoft Excel (.csv) format. Request at least 30 days of records if you can justify it. A month of records is a large enough sample to establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger the sample, the better the analysis. The following is the text I place in the notes of the fax coversheet: o This is in reference case number xxx. Please provide the information in digital format, either in Microsoft Excel, or a format that could be exported to Excel. If you provide the information in a format other than Excel please provide instructions to export to excel. Please the records to me so I can begin working on them immediately. For court purposes I need a certified copy as well. Please provide all the records along with the cell site locations in a single disc, and have the custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian of Records and return the original copy with the records. The information may be mailed to: If you are having Bierce Associates conduct the analysis you may want to include text similar to the following in a cover sheet or memo: o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these records. I respectfully request you allow Mr. Bierce to contact you directly with any questions concerning these records.

13 March 3, 2019 Opposition Name Street Address City, State Zip Code Phone Number Demand for Preservation of Cell Phone Plaintiffs or Defendants demand that you preserve all electronically stored information on your cell phone potentially relevant to the issues in this cause. As used in this document, you and your refers to name of opposition. You should anticipate that much of the information subject to this disclosure or responsive to discovery in this matter is stored on your current and former cell phone(s). Electronically stored information (hereinafter ESI ) should be afforded the broadest possible definition and include, by way of example and not as an exclusive list, potentially relevant information electronically stored on a cell phone as: Contacts A listing of the device s contacts such as name, address, phone number, address, and other contact information. This information can be user generated in a contacts application or can be documentation of a user s contacts through other applications such as social media applications. Calendar Items the user documented in the calendar application such as meetings, events, or birthdays. Items in the calendar can also be generated by other applications such as a scheduling application. Notes Applications allowing the user to enter notes or memos, either text or voice. Call logs Records of phone calls made, received, or missed. These records can come from the phone s native voice communication application or a third-party application through a third-party application. User Dictionaries Smart phones contain dictionaries of words used by the user that aren t in the phone s native dictionary. The feature works in conjunction with the messaging applications to autocomplete words typed in messages or make suggestions. These dictionaries contain slang, jargon, or misspelled words commonly used by the user, which could assist an examiner during keyword searches. User Accounts Information about the user of the phone such as addresses, user names, and associated accounts. The user account information is useful in identifying

14 other web based services or cloud storage accounts that may hold information relevant to the case. Web Browser Data This includes bookmarks and web history. Book marks are links to websites that are saved by default or entered by the user to provide easier access to these websites. Web browser history is documentation of websites visited. Messages This includes Short Message Service (SMS) messages, Multimedia Message Service (MMS), Apple imessage, instant messages, and chat messages. Through the device s native messaging application as well as third-party applications, a user can send and receive messages containing text, audio, video, and photos. Most smart phones have the ability to capture screenshots of what is displayed on the screen and save it as an image. Screenshot images of messages are commonly found on mobile devices. Smart phones have the ability to sync a user s accounts to the mobile device through applications or the web browser. The phone may contain these s. Audio Files Smart phones can store audio files including, but not limited to, voic , music, and audio recordings using the recording function of the phone. Documents Documents such as word processing files, PDF files, and spreadsheets which can be saved to a device. Applications Applications are types of software designed to run on a mobile device, such as a smartphone or tablet. Mobile applications frequently serve to provide users with similar services to those accessed on PCs. Some application types are social media, shopping, and games. These applications can contain communication information, or information about what the user was doing at a certain time. Location information This includes Global Positioning System (GPS) information associates with the metadata in photos, videos, and application databases. This information can also come from cell sites and WiFi networks. Additionally, the GPS function of the phone may include relevant items such as maps, tracks, waypoints, routes, saved locations, favorites, user favorites such as home, recent destinations, city and state history, contact addresses, points of interest, and last GPS fix. Photos Images stored on the phone s or external storage. This includes images captured by the phone s cameras, send and received in messages, downloaded, transferred from other devices, screenshots, and other images created on the phone. Images the user took of him or herself, commonly called selfies, are commonly found on phones. These images may help identify or confirm the identity of the user of the phone. Videos Video movie files captured by the phone or received from another source. Wireless Network Information Phones record wireless network connections, such as WiFi connections, and the locations of these connections.

15 Phone Number the phone number associated with the phone. Subscriber Identity Module (SIM) Card Information The SIM card can contain the phone number associated with the device as well as limited information such as call logs, contacts, and text message records. SIM Cards also contain an Integrated Circuit Card Identifier (ICCID) which is a unique identifier of the SIM card. Subscriber and Equipment Identifiers Such as the serial number, Mobile Equipment Identifier (MEID), Electronic Serial Number (ESN), International Mobile Equipment Identity (IMEI), and International Mobile Subscriber Identity (IMSI). Unallocated Space This is the available space on the storage media to which the operating system can write data. This space could contain data which has previously been deleted but has not yet been overwritten. Information about Cloud Based Services Mobile cloud computing is the combination of mobile networks and cloud computing allowing user applications and data to be stored on the cloud rather than the phone s memory. Identification of these cloud-based services could lead to relevant information. Information about Synced Devices The data contained on a phone is often present on a computer due to the capability of the phone to sync with or otherwise share information among one or more host computers. Paired Devices Phones can be paired with other devices, such as hands-free headsets, smart watches, and remote speakers. Preservation Requires Immediate Intervention You must act immediately to preserve potentially relevant ESI on the phone, without limitation, from the date of a relevant date (may be earlier than the date of the incident) through the date of this demand and concerning: 1. The events and causes of action described in Plaintiff s ComplaintI; 2. ESI you may use to support claims or defenses in this case; Adequate preservation of ESI requires more than simply refraining from efforts to destroy or dispose of such evidence. You must also intervene to prevent loss due to routine operations and employ proper techniques and protocols suited to protection of ESI. Be advised that sources of ESI are altered and erased by continued use of your phone. Smart phones commonly use a type of memory chip called NAND. NAND chips commonly use processes called Wear Leveling and Garbage Collection. NAND chips have a limited lifetime of reads and writes of data on the chip. Wear Leveling is a process that moves data from high traffic areas on the NAND chip to lower areas. This process increases the overall life of

16 the chip. When the data is written to a new area on the chip, any data previously in that area is irretrievably lost. Additionally, for any data to be written to NAND memory, the area to receive the data must be erased. Erasing and writing new data every time new data is written would occupy too many resources, so NAND chips employ a process called Garbage Collection. This process identifies areas on the chip that have old unused data and erases them periodically in order to receive new data faster. Once Garbage Collection has occurred on any area of the chip, the data that was on the chip is irretrievably lost. Any use of the phone may irretrievably alter the evidence it contains and may constitute unlawful spoliation of evidence. Consequently, alteration and erasure may result from your failure to act diligently and responsibly to prevent loss or corruption of ESI. Immediate Steps You are directed to immediately initiate a litigation hold for potentially relevant ESI on the phone, any memory cards, such as Micro SD cards used with the phone, any SIM cards used in the phone, the battery, any paired, connected, or synced devices, any data or power cords or chargers used with the phone, and all passwords, passcodes, or patterns used to unlock the phone along with the user ID and password for any accounts used to set up the phone such as the Google or Apple account used for all profiles on the phone. You should take the following steps: Place the phone in Airplane Mode Remove power from the phone o Turn the phone off o Remove the battery if it is user removable o Do not charge the phone Radio isolate the phone o Should already be in Airplane Mode o Remove the SIM card o Place the phone in a Faraday bag or wrap in several layers of aluminum foil Do not turn the phone on again until it can be forensically examined Record and preserve any passwords, passcodes, or patterns used to unlock the phone along with the user ID and password for any accounts used to set up the phone such as the Google or Apple account used for all profiles on the phone. Phone Sequestration for Forensically Sound Imaging We suggest that the phone be immediately removed from service and properly sequestered and protected as may be an appropriate and cost-effective preservation step. In the event you deem it impractical to sequester the phone, we believe that the breadth of the preservation required, coupled with the modest number of phones implicated, dictates that forensically

17 sound imaging of the phone is expedient and cost effective. As we anticipate the need for forensic examination of the phone and the presence of relevant evidence in the phone, we demand that you employ forensically sound ESI preservation methods. Failure to use such methods poses a significant threat of spoliation and data loss. By forensically sound, we mean duplication, for the purposes of preservation, of all data stored on the phone while employing a proper chain of custody and using tools and methods that make no changes to the evidence and support authentication of the duplicate as a true and complete bit-for-bit image of the original. We understand that this may not be possible with all mobile devices. Generally, there are three levels of examination of a mobile device: Physical, File System, and Logical, with the Physical being the highest level of examination. We recommend the highest possible level of examination of the phone, along with all other lower level examinations available. A forensically sound preservation method guards against changes of metadata evidence and preserves all parts of the electronic evidence, including unallocated space holding deleted files. Preservation Protocols We are desirous of working with you to agree upon an acceptable protocol for forensically sound preservation and can supply a suitable protocol, if you will furnish an inventory of the phones to be preserved. However, if you will promptly disclose the preservation protocol you intend to employ, perhaps we can identify any points of disagreement and resolve them. A successful and compliant ESI preservation requires expertise. If you do not currently have such expertise at your disposal, we urge you to engage the services of an expert in electronic and phone forensics. Perhaps our respective experts can work cooperatively to secure a balance between evidence preservation and id burden that s fair to both sides and acceptable to the court. Do Not Delay Preservation I m available to discuss reasonable preservation steps; however, you should not defer preservation steps pending such discussions as ESI may be lost or corrupted as a consequence of delay. Should your failure to preserve potentially relevant evidence result in the corruption, loss, or delay in production of evidence to which we are entitled, such failure would constitute spoliation of evidence, and we will not hesitate to seek sanctions. Confirmation of Compliance Please confirm by date that you have takes the steps outlined in this letter to preserve ESI and the cell phone relevant to this action. If you have not undertaken the steps outlined above, please describe what you have done to preserve potentially relevant evidence.

18 Respectfully,

19 Benjamin Bierce Revelation Cellular Forensics LLC Professional Experience Owner, Revelation Cellular Forensics, LLC, 2012 to Present Investigator, Franklin, Indiana Police Department, 2016 to Present Instructor, McAfee Institute, 2018 to Present Detective, Computer & Digital Forensics Unit, Indianapolis Metropolitan Police Department, 2015 to 2016 Detective, Homicide/Robbery Branch, Indianapolis Metropolitan Police Department, 2008 to 2015 Police Officer, Indianapolis Metropolitan Police Department/Indianapolis Police Department, 2001 to 2016 Special Agent, U.S. Army Criminal Investigation Division Command (CID), 2003 to 2011 Training and Education Mobile Device Examiner, National Computer Forensics Institute, US Secret Service, 2017 Basic Mobile Device Investigations, National Computer Forensics Institute, US Secret Service, 2015 Mobile Device Investigation Program, Federal Law Enforcement Training Center, 2014 Cell Phone Data and Mapping, Police Technical, 2014 Smartphone Forensics and Advanced Cellular Technology, Public Agency Training Council, 2012 Foundations of Intelligence Analysis Training, Department of Homeland Security/National White Collar Crime Center, 2012 Cyber-Investigations 105 (Basic Cell Phone Investigations), National White Collar Crime Center, 2010 U.S. Army Criminal Investigation Division Command, Basic Warrant Officer Course, 2010 Cyber-Investigations 101 (Secure Techniques for Onsite Preview), National White Collar Crime Center, 2010 Bachelor s Degree in Criminal Justice, Liberty University, 2008

20 Detective Course, Indianapolis Metropolitan Police Department, 2008 U.S. Army Criminal Investigation Division Command Special Agent Course, 2005 Certifications Cellebrite Certified Operator (CCO), August, 2017 to December 2019 MSAB XRY Level 2 Certification, August, 2017 to August, 2019 Private Investigator License, Texas, 2016-Present Speaking Engagements Cleveland Academy of Trial Attorneys, Cell Phone Evidence in Civil Litigation, December, 2018 Indiana Continuing Legal Education Forum, Advanced Family Law, July, 2017 Cincinnati Bar Association, Cell Phone Evidence in Civil Litigation, June, 2017 Akron Bar Association, Cell Phone Evidence in Criminal Litigation, June, 2017 Louisville Bar Association, Cell Phone Evidence in Civil Litigation, May, 2017 Chicago Bar Association, Cell Phone Evidence in Civil Litigation, April, 2017 Monroe County (IN) Bar Association, Bench Bar Conference, Cell Phone Evidence in Civil Litigation, February, 2017 Indiana Continuing Legal Education Forum, Family Law Institute, Cell Phone Evidence in Family Law, October, 2016 Ohio State Bar Association, Webinar, Cell Phone Record Analysis in support of Criminal Cases, June, 2016 Allen County (IN) Bar Association, Cell Phone Record Analysis in support of Litigation, June, 2016 Ohio State Bar Association, Webinar, Cell Phone Record Analysis in support of Civil Litigation, May, 2016 Indiana Continuing Legal Education Forum, Year in Review Conference, Preserving and Obtaining Cell Phone Records, December, 2015 Indiana Continuing Legal Education Forum, Preserving and Obtaining Cell Phone Records, June, 2015 Defense Trial Counsel of Indiana, Annual Conference, Trial Tactics, November, 2014 Indiana University Law School, Guest Speaker, ediscovery, June, 2014 Defense Trial Counsel of Indiana, Annual Conference Breakout Session, November 2013 Indiana Continuing Legal Education Forum, Using Cell Phone Records in Civil Litigation, October, 2013

21 US Attorney's Law Enforcement Conference, Homicide Case Study, September, 2013 Marion County Prosecutors Office, Cell Phone Training for Prosecutors, July, 2013 ITT Technical Institute, Guest Speaker, Criminal Justice, July 2013 Court Testimony State v. Miles Toran, 49G MR , Marion County, Indiana State v. Maron Jackson, 49G MR , Marion County, Indiana State v. Lamar Wooden, 49G MR , Marion County, Indiana State v. Daryl Gilbert, 49G MR , Marion County, Indiana State v. Daniel Hoskins, 49G MR , Marion County, Indiana State v. Carlton Hart, 49G MR , Marion County, Indiana State v. Ryan Clark, 49G MR , Marion County, Indiana State v. Donna Fitzgerald, 49G FB , Marion County, Indiana State v. James Wade, 49G MR , Marion County, Indiana State v. Omar Davis, 49G F , Marion County, Indiana State v. Cortez Jones, 49G MR , Marion County, Indiana State v. Philip Garrett, 49G MR , Marion County, Indiana State v. Kenneth Brittain, 49G MR , Marion County, Indiana State v. Heidi Carpenter, 49G MR , Marion County, Indiana State v. Marchello Heard, 49G FA , Marion County, Indiana State v. Dominique Hamler, 49G MR , Marion County, Indiana State v. Desmond Aaron, 49G F , Marion County, Indiana State v. Anthony Spearman, 49G MR , Marion County, Indiana State v. Devin Brookins, 49G MR , Marion County, Indiana State v. James Jenkins, 49G MR , Marion County, Indiana State v. Eric Johnson, 49G MR , Marion County, Indiana State v. John Webb, 49G MR , Marion County, Indiana State v. Bob Leonard, 02D MR , Allen County, Indiana State v. Bryant Dowdy, 49G MR , Marion County, Indiana State v. Nicko Bryant-Williams, 49G MR , Marion County, Indiana State v. Jasen Lockwood, 49G F , Marion County, Indiana State v. John Means, 49G MR , Marion County, Indiana State v. Desmond Aaron. 49G MR , Marion County, Indiana Unger v. Dirt Trucking. 35D PL , Huntington County, Indiana Depositions State v. Anthony Spearman, 49G MR , Marion County, Indiana

22 State v. Cortez Jones, 49G MR , Marion County, Indiana State v. William Rainsberger, 49G MR , Marion County, Indiana State v. James Wade, 49G MR , Marion County, Indiana State v. Kenneth Brittain, 49G MR , Marion County, Indiana State v. Richard Burns, 49G MR , Marion County, Indiana State v. Kenneth Rackemann, 49G MR , Marion County, Indiana State v. Eric Johnson, 49G MR , Marion County, Indiana State v. Charles Wade, 49G FA , Marion County, Indiana State v. Maron Jackson, 49G MR , Marion County, Indiana Relevant Experience and Activities I have analyzed more than 1200 sets of phone records in both criminal and civil cases. I have testified regarding cell phone records in 28 criminal jury trials. I established a program to obtain and analyze phone records for the Indianapolis Metropolitan Police Department. From 2012 to present I have been involved with the Kairos Prison Ministry, where I regularly give talks and presentations. From 2010 to present, my wife and I have coordinated Financial Peace University at our church, where we give presentations, and guide and mentor students through a 13 or 9 week course. From 2004 to 2011 I was the Training Officer or Training Noncommissioned Officer for the 378 th MP Detachment (CID), U.S. Army Reserve. I was responsible for establishing and implementing the unit s training program. I supervised soldiers in the development and presentation of individual classes.