Carrier-Specific Preservation Requests

Transcription

1 Carrier-Specific Preservation Requests RevForensics.com 5911 N Road 400 W, Bargersville IN

2 AT&T Civil Preservation Request RevForensics.com 5911 N Road 400 W, Bargersville IN

3 October 11, 2017 AT&T Mobility National Court Order Compliance US Highway 1, Suite 600 North Palm Beach, FL (800) Fax (888) Dear Sir or Ma am, I am conducting an investigation and have identified the phone number as likely being pertinent to this case. Per 18 USC 2703, I am requesting AT&T Mobility preserve the records for the phone number , to include the following: 1. Subscriber information for the number including by way of example and not limitation: a. Subscriber Name b. Subscriber Address c. Identifying information such as date of birth, driver s license number, and/or social security number d. Subscriber contact information including addresses and contact phone numbers 2. Billing and credit information for the phone number including by way of example and not limitation: a. Method and source of payment information including credit card numbers, electronic funds transfers, and locations of cash payments b. Credit information including any credit report run by the provider prior to the authorizing service 3. Service information for the phone number including by example and not limitation: a. Purchase and activation location b. Types of service subscribed to c. Additional phone numbers associated with the same account d. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account 4. Call Detail Records for the wireless number for the days of 06/01/2015 to 07/01/2015, Eastern Time, including: a. Cellular calls, b. SMS/MMS messages c. Data communication d. Tower locations (LAC/CID) and azimuth for the sectors accessed during the communication 5. Any data in the AT&T cloud services associated with the wireless number , including by way of example and not limitation a. SMS, MMS, b. s communications 6. Location of the phone with the wireless number using Network Event Location System (NELOS) and Mobile Locator Tool data including reliability factors for the communication for the days of 06/01/2015 to 07/01/2015, Eastern Time. 7. Voice Mail Messages including content

4 8. A detailed definitions page which identifies all information in the records I will follow up with a court order or subpoena as needed. Thank you for your assistance. Sincerely, Benjamin Bierce Revelation Cellular Forensics LLC ben@revforensics.com

5 Notes for Preparing the Legal Demand AT&T maintains records for the following periods o Cell sites for voice, text, and data back to July 2008 o NELOS, about 30 days o They do not store the content of text messages at all AT&T will supply the records with cell tower information from a subpoena, but a court order will result in a quicker turnaround. Be sure to request the records in digital format, specifically in.txt format, on a CD with the preparer s signature on it and a notarized copy of the Affidavit of Custodian of Records. AT&T provides digital records in PDF format by default, but will provide them in.txt format upon request. For analysis, I much prefer the.txt format. Request at least 30 days of records if you can justify it. A month of records is a large enough sample to establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger the sample, the better the analysis. The following is the text I place in the notes of the fax coversheet o This is in reference case number xxx. Please provide the information in.txt format. Please the records to me so I can begin working on them immediately. For court purposes, I need a certified copy as well. Please provide all the records along with the cell site locations in a single disc, and have the custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian of Records and return the original copy with the records. The information may be mailed to: If you are having Revelation Cellular Forensics conduct the analysis you may want to include text like the following: o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these records. I respectfully request you allow Mr. Bierce to contact you directly with any questions concerning these records.

6 Metro PCS Civil Preservation Request RevForensics.com 5911 N Road 400 W, Bargersville IN

7 October 11, 2017 Metro PCS/T-Mobile, USA Law Enforcement Relations 4 Sylvan Parsippany, NJ (973) Fax (973) Dear Sir or Ma am, I am conducting an investigation in a civil case and have identified the phone number as likely being pertinent to this case. Per 18 USC 2703, I am requesting Metro PCS/T- Mobile, USA preserve the records for the phone number , to include the following: 1. Subscriber information for the number including by way of example and not limitation: a. Subscriber Name b. Subscriber Address c. Identifying information such as date of birth, driver s license number, and/or social security number d. Subscriber contact information including addresses and contact phone numbers 2. Billing and credit information for the phone number including by way of example and not limitation: a. Method and source of payment information including credit card numbers, electronic funds transfers, and locations of cash payments b. Credit information including any credit report run by the provider prior to the authorizing service 3. Service information for the phone number including by example and not limitation: a. Purchase and activation location b. Types of service subscribed to c. Additional phone numbers associated with the same account d. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account

8 4. Call Detail Records for the wireless number for the days of 1/1/2015 to2/1/2015, Eastern Time, including: a. Cellular calls, b. SMS/MMS messages c. Data communication d. Tower locations (LAC/CID) and azimuth for the sectors accessed during the communication 5. A list of all T-Mobile cell towers with latitude, longitude, address, and sector directions and beam widths 6. Voice Mail Messages and Text Messages including content 7. A detailed definitions page which identifies all information in the records 8. Please provide records in Eastern Time I will follow up with a search warrant as needed. Thank you for your assistance. Sincerely, Benjamin Bierce Revelation Cellular Forensics LLC ben@revforensics.com

9 Notes for Preparing the Legal Demand Metro PCS/T-Mobile maintains records for the following periods o Cell sites for voice two years o No cell sites for text messages or data o They do not store the content of text messages at all Metro PCS/T-Mobile requires a court order to produce the records. Be sure to request the records in digital format on a CD with the preparer s signature on it and a notarized copy of the Affidavit of Custodian of Records. Metro PCS/T-Mobile provides the records in Microsoft Excel format. A spreadsheet containing all the T-Mobile cell sites is necessary for the analysis, and T-Mobile is inconsistent about sending them. Follow up contact may be necessary but no additional legal demand would be needed. Request at least 30 days of records if you can justify it. A month of records is a large enough sample to establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger the sample, the better the analysis. The following is the text I place in the notes of the fax coversheet: o This is in reference case number xxx. Please provide the information in digital format, either in Microsoft Excel, or a format that could be exported to Excel. If you provide the information in a format other than Excel please provide instructions to export to excel. Please the records to me so I can begin working on them immediately. For court purposes I need a certified copy as well. Please provide all the records along with the cell site locations in a single disc, and have the custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian of Records and return the original copy with the records. The information may be mailed to: If you are having Revelation Cellular Forensics conduct the analysis you may want to include text like the following: o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these records. I respectfully request you allow Mr. Bierce to contact you directly with any questions concerning these records.

10 Sprint Civil Preservation Request RevForensics.com 5911 N Road 400 W, Bargersville IN

11 February 1, 2014 Sprint Corporation Security & Subpoena Compliance 6480 Sprint Parkway MS: KSOPHM0216 Overland Park, KS (800) Fax (816) Dear Sir or Ma am, I am conducting an investigation and have identified the phone number as likely being pertinent to this case. Per 18 USC 2703, I am requesting Sprint Corporation preserve the records for the phone number , to include the following: 1. Subscriber information (Expanded) for the number including by way of example and not limitation: a. Subscriber Name b. Subscriber Address c. Identifying information such as date of birth, driver s license number, and/or social security number d. Subscriber contact information including addresses and contact phone numbers 2. Billing and credit information (Payment Information) for the phone number including by way of example and not limitation: a. Method and source of payment information including credit card numbers, electronic funds transfers, and locations of cash payments b. Credit information including any credit report run by the provider prior to the authorizing service 3. Service information for the phone number including by example and not limitation: a. Purchase and activation location b. Types of service subscribed to c. Additional phone numbers associated with the same account d. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account

12 4. Call Detail Records for the wireless number for the days of 07/01/2015 to 08/01/2015, Eastern Time, including by example and not limitation: a. Cellular calls (Call Detail Records with Cell Site Location) b. SMS/MMS messages c. Data communication (IPDR w/ Cell Site, Web Site Address Report) d. Tower locations (NEID, Cell Number, Sector Number, enode) and azimuth for the sectors accessed during the communication 5. Voice Mail Messages including content (Stored Voice Mail Reproduction) 6. PCMD (Per Call Measurement Data) for the cellular phone number for the days of 07/01/2015 to 08/01/2015, Eastern Time, to include reliability factors for the communication 7. A detailed definitions page which identifies all information in the records I will follow up with a court order or subpoena as needed. Thank you for your assistance. Sincerely, Benjamin Bierce Revelation Cellular Forensics LLC ben@revforensics.com

13 Notes for Preparing the Legal Demand Sprint maintains records for the following periods o Cell sites for voice only for 18 to 24 months o No cell sites for text messages or data o They do not store the content of text messages at all o PCMD (Per Call Measurement Data) is stored for 14 days Sprint requires a court order to produce the records. Be sure to request the records in digital format on a CD with the preparer s signature on it and a notarized copy of the Affidavit of Custodian of Records. Sprint provides the records in Microsoft Excel format. A spreadsheet containing all the Sprint cell sites is necessary for the analysis, and Sprint is inconsistent about sending them. Follow up contact may be necessary but no additional legal demand would be needed. Request at least 30 days of records if you can justify it. A month of records is a large enough sample to establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger the sample, the better the analysis. The following is the text I place in the notes of the fax coversheet: o This is in reference case number xxx. Please provide the information in digital format, either in Microsoft Excel, or a format that could be exported to Excel. If you provide the information in a format other than Excel please provide instructions to export to excel. Please the records to me so I can begin working on them immediately. For court purposes I need a certified copy as well. Please provide all the records along with the cell site locations in a single disc, and have the custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian of Records and return the original copy with the records. The information may be mailed to: If you are having Bierce Associates conduct the analysis you may want to include text similar to the following: o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these records. I respectfully request you allow Mr. Bierce to contact you directly with any questions concerning these records.

14 T-Mobile Civil Preservation Request RevForensics.com 5911 N Road 400 W, Bargersville IN

15 October 11, 2017 T-Mobile, USA Law Enforcement Relations 4 Sylvan Parsippany, NJ (973) Fax (973) Dear Sir or Ma am, I am conducting an investigation in a civil case and have identified the phone number as likely being pertinent to this case. Per 18 USC 2703, I am requesting T-Mobile, USA preserve the records for the phone number , to include the following: 1. Subscriber information for the number including by way of example and not limitation: a. Subscriber Name b. Subscriber Address c. Identifying information such as date of birth, driver s license number, and/or social security number d. Subscriber contact information including addresses and contact phone numbers 2. Billing and credit information for the phone number including by way of example and not limitation: a. Method and source of payment information including credit card numbers, electronic funds transfers, and locations of cash payments b. Credit information including any credit report run by the provider prior to the authorizing service 3. Service information for the phone number including by example and not limitation: a. Purchase and activation location b. Types of service subscribed to c. Additional phone numbers associated with the same account d. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account

16 4. Call Detail Records for the wireless number for the days of 1/1/2015 to2/1/2015, Eastern Time, including: a. Cellular calls, b. SMS/MMS messages c. Data communication d. Tower locations (LAC/CID) and azimuth for the sectors accessed during the communication 5. A list of all T-Mobile cell towers with latitude, longitude, address, and sector directions and beam widths 6. Voice Mail Messages and Text Messages including content 7. A detailed definitions page which identifies all information in the records 8. Please provide records in Eastern Time I will follow up with a search warrant as needed. Thank you for your assistance. Sincerely, Benjamin Bierce Revelation Cellular Forensics LLC ben@revforensics.com

17 Notes for Preparing the Legal Demand T-Mobile maintains records for the following periods o Cell sites for voice and text, 2 years o No cell sites for or data o They do not store the content of text messages at all T-Mobile requires a court order to produce the records. Be sure to request the records in digital format on a CD with the preparer s signature on it and a notarized copy of the Affidavit of Custodian of Records. T-Mobile provides the records in Microsoft Excel format. A spreadsheet containing all the T-Mobile cell sites is necessary for the analysis, and T-Mobile is inconsistent about sending them. Follow up contact may be necessary but no additional legal demand would be needed. Request at least 30 days of records if you can justify it. A month of records is a large enough sample to establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger the sample, the better the analysis. The following is the text I place in the notes of the fax coversheet: o This is in reference case number xxx. Please provide the information in digital format, either in Microsoft Excel, or a format that could be exported to Excel. If you provide the information in a format other than Excel please provide instructions to export to excel. Please the records to me so I can begin working on them immediately. For court purposes I need a certified copy as well. Please provide all the records along with the cell site locations in a single disc, and have the custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian of Records and return the original copy with the records. The information may be mailed to: If you are having Bierce Associates conduct the analysis you may want to include text similar to the following: o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these records. I respectfully request you allow Mr. Bierce to contact you directly with any questions concerning these records.

18 Verizon Civil Preservation Request RevForensics.com 5911 N Road 400 W, Bargersville IN

19 August 1, 2015 Verizon Wireless Law Enforcement Resource Team 180 Washington Valley Rd. Bedminster, NJ (800) Fax (888) Dear Sir or Ma am, I am conducting an investigation in a civil case and have identified the phone number as likely being pertinent to this case. Per 18 USC 2703, I am requesting Verizon Wireless preserve the records for the phone number , to include the following: 1. Subscriber information for the number including by way of example and not limitation: a. Subscriber Name b. Subscriber Address c. Identifying information such as date of birth, driver s license number, and/or social security number d. Subscriber contact information including addresses and contact phone numbers 2. Billing and credit information for the phone number including by way of example and not limitation: a. Method and source of payment information including credit card numbers, electronic funds transfers, and locations of cash payments b. Credit information including any credit report run by the provider prior to the authorizing service c. Payment Activity d. Payment History e. Auto Bill Copy 3. Service information for the phone number including by example and not limitation: a. Purchase and activation location b. Activation/Deactivation Dates c. Types of service subscribed to

20 d. Additional phone numbers associated with the same account (Other Numbers on Account) e. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account (Device ID) 4. Call Detail Records for the wireless number for the days of 06/01/2015 to 07/01/2015, Eastern Time including: a. Cellular calls, (Cell-Site Incoming, Outgoing) b. SMS/MMS messages (Historical MMS Detail, Text Message Detail, Auto Text Message Content, Auto Picture Content, Picture content, Auto Picture Detail, Picture Message Detail) c. Data communication (IP Destination, IP Session) d. Tower locations (Switch/Element, Cell Numbers, Sector Numbers) and azimuth for the sectors accessed during the communication 5. Voic Messages including content (Voic Password Reset) 6. RTT (Round Trip Time) for the cellular phone number for the days of 06/01/2015 to 07/01/2015, Eastern Time, to include reliability factors for the communication 7. Any data in the Verizon cloud services associated with the wireless number , including by way of example and not limitation a. SMS, MMS, b. s communications 8. A detailed definitions page which identifies all information in the records I will follow up with a search warrant as needed. Thank you for your assistance. Sincerely, Benjamin Bierce Revelation Cellular Forensics LLC ben@revforensics.com

21 Notes for Preparing the Legal Demand Verizon maintains records for the following periods o Cell sites for voice only for 12 months o No cell sites for text messages or data o They do the content of text messages for 7 days o RTT (Round Trip Time) is stored for 7 days Verizon will honor a subpoena, but a court order will result in a faster return. Be sure to request the records in digital format on a CD with the preparer s signature on it and a notarized copy of the Affidavit of Custodian of Records. Verizon provides the records in Microsoft Excel (.csv) format. Request at least 30 days of records if you can justify it. A month of records is a large enough sample to establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger the sample, the better the analysis. The following is the text I place in the notes of the fax coversheet: o This is in reference case number xxx. Please provide the information in digital format, either in Microsoft Excel, or a format that could be exported to Excel. If you provide the information in a format other than Excel please provide instructions to export to excel. Please the records to me so I can begin working on them immediately. For court purposes I need a certified copy as well. Please provide all the records along with the cell site locations in a single disc, and have the custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian of Records and return the original copy with the records. The information may be mailed to: If you are having Bierce Associates conduct the analysis you may want to include text similar to the following in a cover sheet or memo: o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these records. I respectfully request you allow Mr. Bierce to contact you directly with any questions concerning these records.

22 Bierce CV RevForensics.com 5911 N Road 400 W, Bargersville IN

23 Benjamin Bierce Revelation Cellular Forensics LLC Professional Experience Owner, Revelation Cellular Forensics, LLC, 2012 to Present Investigator, Franklin, Indiana Police Department, 2016 to Present Detective, Computer & Digital Forensics Unit, Indianapolis Metropolitan Police Department, 2015 to 2016 Detective, Homicide/Robbery Branch, Indianapolis Metropolitan Police Department, 2008 to 2015 Police Officer, Indianapolis Metropolitan Police Department/Indianapolis Police Department, 2001 to 2016 Special Agent, U.S. Army Criminal Investigation Division Command (CID), 2003 to 2011 Training and Education Mobile Device Examiner, National Computer Forensics Institute, US Secret Service, 2017 Basic Mobile Device Investigations, National Computer Forensics Institute, US Secret Service, 2015 Mobile Device Investigation Program, Federal Law Enforcement Training Center, 2014 Cell Phone Data and Mapping, Police Technical, 2014 Smartphone Forensics and Advanced Cellular Technology, Public Agency Training Council, 2012 Foundations of Intelligence Analysis Training, Department of Homeland Security/National White Collar Crime Center, 2012 Cyber-Investigations 105 (Basic Cell Phone Investigations), National White Collar Crime Center, 2010 U.S. Army Criminal Investigation Division Command, Basic Warrant Officer Course, 2010 Cyber-Investigations 101 (Secure Techniques for Onsite Preview), National White Collar Crime Center, 2010 Bachelor s Degree in Criminal Justice, Liberty University, 2008 Detective Course, Indianapolis Metropolitan Police Department, 2008 U.S. Army Criminal Investigation Division Command Special Agent Course, 2005 Certifications Cellebrite Certified Operator (CCO), August, 2017 to December 2019 MSAB XRY Level 2 Certification, August, 2017 to August, 2019 Speaking Engagements Indiana Continuing Legal Education Forum, Advanced Family Law, July, 2017 Cincinnati Bar Association, Cell Phone Evidence in Civil Litigation, June, 2017 Akron Bar Association, Cell Phone Evidence in Criminal Litigation, June, 2017

24 Louisville Bar Association, Cell Phone Evidence in Civil Litigation, May, 2017 Chicago Bar Association, Cell Phone Evidence in Civil Litigation, April, 2017 Monroe County (IN) Bar Association, Bench Bar Conference, Cell Phone Evidence in Civil Litigation, February, 2017 Indiana Continuing Legal Education Forum, Family Law Institute, Cell Phone Evidence in Family Law, October, 2016 Ohio State Bar Association, Webinar, Cell Phone Record Analysis in support of Criminal Cases, June, 2016 Allen County (IN) Bar Association, Cell Phone Record Analysis in support of Litigation, June, 2016 Ohio State Bar Association, Webinar, Cell Phone Record Analysis in support of Civil Litigation, May, 2016 Indiana Continuing Legal Education Forum, Year in Review Conference, Preserving and Obtaining Cell Phone Records, December, 2015 Indiana Continuing Legal Education Forum, Preserving and Obtaining Cell Phone Records, June, 2015 Defense Trial Counsel of Indiana, Annual Conference, Trial Tactics, November, 2014 Indiana University Law School, Guest Speaker, ediscovery, June, 2014 Defense Trial Counsel of Indiana, Annual Conference Breakout Session, November 2013 Indiana Continuing Legal Education Forum, Using Cell Phone Records in Civil Litigation, October, 2013 US Attorney's Law Enforcement Conference, Homicide Case Study, September, 2013 Marion County Prosecutors Office, Cell Phone Training for Prosecutors, July, 2013 ITT Technical Institute, Guest Speaker, Criminal Justice, July 2013 Trial Testimony State v. Miles Toran, 49G MR , Marion County, Indiana State v. Maron Jackson, 49G MR , Marion County, Indiana State v. Lamar Wooden, 49G MR , Marion County, Indiana State v. Daryl Gilbert, 49G MR , Marion County, Indiana State v. Daniel Hoskins, 49G MR , Marion County, Indiana State v. Carlton Hart, 49G MR , Marion County, Indiana State v. Ryan Clark, 49G MR , Marion County, Indiana State v. Donna Fitzgerald, 49G FB , Marion County, Indiana State v. James Wade, 49G MR , Marion County, Indiana State v. Omar Davis, 49G F , Marion County, Indiana State v. Cortez Jones, 49G MR , Marion County, Indiana State v. Philip Garrett, 49G MR , Marion County, Indiana State v. Kenneth Brittain, 49G MR , Marion County, Indiana State v. Heidi Carpenter, 49G MR , Marion County, Indiana State v. Marchello Heard, 49G FA , Marion County, Indiana State v. Dominique Hamler, 49G MR , Marion County, Indiana State v. Desmond Aaron, 49G F , Marion County, Indiana State v. Anthony Spearman, 49G MR , Marion County, Indiana State v. Devin Brookins, 49G MR , Marion County, Indiana

25 State v. James Jenkins, 49G MR , Marion County, Indiana State v. Eric Johnson, 49G MR , Marion County, Indiana State v. John Webb, 49G MR , Marion County, Indiana State v. Bob Leonard, 02D MR , Allen County, Indiana State v. Bryant Dowdy, 49G MR , Marion County, Indiana State v. Nicko Bryant-Williams, 49G MR , Marion County, Indiana State v. Jasen Lockwood, 49G F , Marion County, Indiana State v. John Means, 49G MR , Marion County, Indiana State v. Desmond Aaron. 49G MR , Marion County, Indiana Depositions State v. Anthony Spearman, 49G MR , Marion County, Indiana State v. Cortez Jones, 49G MR , Marion County, Indiana State v. William Rainsberger, 49G MR , Marion County, Indiana State v. James Wade, 49G MR , Marion County, Indiana State v. Kenneth Brittain, 49G MR , Marion County, Indiana State v. Richard Burns, 49G MR , Marion County, Indiana State v. Kenneth Rackemann, 49G MR , Marion County, Indiana State v. Eric Johnson, 49G MR , Marion County, Indiana State v. Charles Wade, 49G FA , Marion County, Indiana State v. Maron Jackson, 49G MR , Marion County, Indiana Relevant Experience and Activities Since 2010 I have analyzed over 1200 sets of phone records in both criminal and civil cases. I have testified regarding cell phone records in 28 criminal jury trials. In 2012 I established a program to obtain and analyze phone records for the Indianapolis Metropolitan Police Department. I have testified in homicide, robbery, arson, and sex crimes trials. From 2012 to present I have been involved with the Kairos Prison Ministry, where I regularly give talks and presentations. From 2010 to present, my wife and I have coordinated Financial Peace University at our church, where we give presentations, and guide and mentor students through a 13 or 9 week course. From 2004 to 2011 I was the Training Officer or Training Noncommissioned Officer for the 378 th MP Detachment (CID), U.S. Army Reserve. I was responsible for establishing and implementing the unit s training program. I supervised soldiers in the development and presentation of individual classes.