ub COMMONWEALTH OF MASSACHUSETTS. SUPERIOR COURT DEPARTMENT NO. 2282-CR-00117 NORFOLK, SS. ) 2 COMMONWEALTH OF ) ~ MASSACHUSETTS, ) a 2 iff ) sa ) 3.5 v. ) a ) KAREN READ, ) 2 ) eo Defendant ———— 1 AFFIDAVIT OF RICHARD GREEN IN SUPPORT OF DEFENDANT'S MOTION FOR ORDER PURSUANT TO MASS. R. CRIM. P. 17 DIRECTED TO BRIAN ALBERT, VERIZON, AND AT&T 1, Richard Green, under oath, do depose and state as follows: I. am a data forensics expert with United States Forensics, LLC (hereinafter, “USF”). Tam a Centified Computer Examiner with the International Association of Computer Forensic Examiners and hold certifications in Cybersecurity, Computer Crime Investigations, and Digital Forensics and Computer Investigations, A.S, 2. ‘The following facts and information are based on my own personal knowledge, and I could testify competently thereto if called upon as an expert witness to do so. I declare that the following is true and correct to the best of my knowledge and that I have no personal interest in the outcome of this case. 3. USF has received, inter alia, Cell Phone Data Images of two iPhone devices, which were forensically imaged by the Massachusetts State Police in connection with this case. They have been centered into evidence as follows (USF Evidence number followed by description, owner, and serial number): + 22-398304, iPhonel 1 JMcCabe, Jennifer McCabe, GONCXSRRN72W + 22-398310, iPhone! 1 O'Keefe, John O'Keefe, FAGFRBEQN72Q 4, The Data Images have been processed and reviewed with Cellebrite Physical Analyzer ed include BelkasoftX, Sanderson V7.61.0.12 and Axiom Forensics V6.L1. Additional forensic tools uti. Al times listed have been converted to ‘SQLite Forensic Explorer, and Cellhawk by Hawk Analyt Canton, MA local time (UTC-5) unless otherwise noted. ANALYSIS OF JENNIFER MCCABE’S iPHONE 11 5. [have analyzed the data obtained from the forensic image of Jennifer McCabe's iPhone 11 (Serial No. GONCXSRRN72W / USF Evidence No. 22-398304) using the tools outlined in Paragraph 4 above. That analysis has revealed significant exculpatory evidence. ‘Search History 6. Inmy professional experience, an analysis of the device’s internet search history often gives ‘valuable clues as to the user's intent or knowledge surrounding an incident. I conducted a review of the search history information obtained from Jennifer McCabe's iPhone 11, and observed the following significant artifact from the morning in question: + Search Term: hos long to die in cold © Date/Time: 1/29/2022 2:27:40 AM + URL: https:/www.google.com/search?q-hos+long+to*die+in+cold&ie=UTF-B&0e-UTF- 8&hi-en-usétclient=safari + Source: Safari Suspended State Tab + State: Deleted (as reported by Cellebrite) ‘Thus, search history information obtained from Jennifer McCabe's cell phone indicates that on January 29, 2022, at 2:27:40 a.m., the phone’s user entered the following search in Safari: “hos long to die in cold.” & true and correct copy of the Cellebrite information associated with this artifact is attached hereto as “USE-O1.” 7. In order to confirm the accuracy of this search event as reported in Cellebrite, | independently performed a low-level analysis of the artifuct found in “USR-O1”, which was located in the BrowserState.db-wal (“Write Ahead File”). Write Ahead Files are temporary in nature, and show the location where data is written before commitments to the main database are made. ‘The particulars of this artifact are as follows: + Location: \private\var\mobile\Library\Safari\BrowserState.db-wal * Database Record ID: 4028 + Raw time data: 665134060.465336 + Time Converted to UTC: Saturday, January 29, 2022 07: 2+ Adjusted to Local time: January 29, 2022 02:27:40 AM (UTC-5). ‘Thus, I was able to independently verify that the time, date, and fact of the search reported in Cellebrite ‘was accurate. 8. Significantly, the Cellebrite analysis further reveals that the 2:27:40 a.m. search for “hos Jong to die in cold” was thereafter deleted by the user. The BrowerState.db dataset contains information about the Open Tabs in the safari application. This allows a user to leave the application and then return at lual tabs can be deleted by the user. Here, Cellebrite ‘indicates that the 2:27:40 a.m. search for “hos long to die in cold” was deleted by the user. 9. Lalso performed a timeline validation of the 2:27:40 a.m. search, by confirming that the device ‘was in use atthe time of the search. The following artifacts support that user was interacting with the a later time to resume the browser session. ‘The indi phone during this period. ‘+ The iPhone was unlocked between 2:23:31 AM and 2:31:07 AM ‘+ Text Messages were sent at 2:25:11 AM and 2:25:56 AM ‘+ Two screenshots were deleted at 2:26:37 AM ‘= The search for “hos long to die in cold” was entered at 2:27:40 a.m. ‘Thus, the data unequivocally establishes that an individual using Jennifer McCabe's iPhone 11 searched “hos long to die in cold” at 2:27:40 am. on January 29, 2022. 10. A further review of searched artifacts revealed that the user of Jennifer McCabe's iPhone 11 conducted several similar searches later that moming on January 29, 2022. A true and correct copy of these subsequent searches are attached hereto as “USR-02,” and include the following, + 1/29/2022 06:23:51 AM - how long ti die in cikd + 1/29/2022 06:24:18 AM - hos long to die in cold 1, Twas also able to locate an additional artifact, attached hereto as “UUSF-03,” which was recovered from the Safari Cache Records and indicates that the user also conducted the following search: + 1/29/2022 06:23:49 AM - how long does it take to digest food. * Found in: https-//edn2.smoot.apple.com/image?,sig=tnfvltCqZD6Q_s EQNpFag%3 D%3D&domain=web_indexs-image_urlhttps%3A%2F%2F2.zoppoz.workers.dev%3A443%2Fhttps%2Fpost.healthline.com%2Fwp- content%2F uploads%2F2020%2F0292F732x549_THUMBNAIL, How long_does_it take _to_digest_food.jpg&spec=120-180-NC-0Deleted Call Logs 12, Talso conducted a forensic analysis of the users’ call log history from the date in question. An may be of interest. analysis of a device’s call history is helpful in determining associates of the user, whi ‘A.user’s call history is automatically recorded and stored on a user's cell phone. The absence of recent historical call information suggests that a user has taken affirmative steps to delete the call history. In my professional opinion, the confirmed deletion of recent historical call information suggests that a user has ‘engaged in efforts to tamper with, alter, destroy, and/or hide information or evidence. Importantly, deleted information is not always recoverable. ‘The Call Log artifacts were examined using Cellebrite’s Physical Analyzer and are attached hereto as “USF-04”. Further analysis was performed with Axiom Forensics, both of which suggest that there were significant deletions of call data by the user of Jennifer McCabe's iPhone 11: + 10/24/2020 to 1/27/2022 - Only Facetime Call Data is recorded (Parsed by Axiom). + 01/28/2022 —No Call Log data found in CallHistory.storedata.db (main storage location) but indications of calls found in KnowledgeC database (records various user activity) + 01/29/2022 - 18 Deleted Call Entries between 5:33:47 AM and 8:50:15 AM ‘+ 01/29/2022 - The 6:03:47 AM 911 Call is deleted, (Included in the 18 above). 217 AM calls to “Coco” aka Nicole Albert are © 01/29/2022 - The 6:07:42 AM and 6: deleted (Included in the 18 above) ‘+ 01/29/2022 - The 6:23:00 AM call to “uncle brian a” is deleted (Included in the 18 above) ‘+ 01/29/2022 8:59:34 a.m, to 2/2/2022 - Normal Call Log Activity found. 13, In this case I was able to further verify that there were additional deletions which were not recovered from Jennifer McCabe’s iPhone 11 using Cellebrite, by cross-referencing the deleted call entries from Jennifer McCabe’s cell phone with data obtained from John O’Keefe’s and Karen Read’s cell phones. + 01/29/2022 - There are 17 calls listed on John O’Keefe iPhone referencing Jennifer ‘McCabe's cell phone number (7818580142) on 1/29/2022 attached hereto as “USF-05". Only one of these calls is found in the IMcCabe iPhone CallHistory.storedata.db and that, particular artifact is listed as deleted (highlighted in Green on “USF-04”). + 01/29/2022 - There are eight calls listed on Karen Read's iPhone call log referencing, Jennifer McCabe cell phone number (7818580142) on 1/29/2022 attached hereto as “USF-06". Of these eight calls, only two ate found in the JMcCabe iPhone CallHistory.storedata.db (highlighted in Yellow on “USF-04") ‘Thus, I was able to determine that certain call log history and data was missing from Jennifer McCabe's iPhone, which could not be recovered using Cellebrite. In order to obtain a complete accounting of the calls that could not be recovered using Cellebrite, I will need to obtain call detail records from Jennifer McCabe's cell phone carrier and cross-reference that information with the data obtained from the analysis itional devices that should be preserved of her cell phone. This analysis may lead to the discovery of ad and analyzed. Acquisition and preservation should include potential backup sources such as computers and cloud storage platforms as well as synced devices such as tablets. Deleted Screen Shot 14, In addition to the above data that was deleted from Jennifer McCabe's iPhone, a screenshot of ‘a contact saved as “uncle brian a” described as “home #3” with the associated phone number (617) 777- (0888, was found to have been created on 1/29/2022 @ 6:08:35 AM, and was deleted later that day at 12:53:23 PM. A true and correct copy of that artifact is attached hereto as “USE-07.” It is noted that Jennifer MeCabe's brother- 777-0888. Location Data -law is Brian Albert, whose cell phone number has been confirmed as (617) 15. An analysis of a device's location data is helpful to determine the user's whereabouts during specific incidents. iPhones store various location data with varying degrees of accuracy. When an application request’s location data, the iOS responds with what is known as Apple Location Services and Assisted GPS. Some applications may require only regional data (such as weather applications) and other ones highly accurate data (such as driving applications, as in Waze). 16. In an effort to determine the whereabouts of Jennifer McCabe’s iPhone on January 29, 2022, location data was exported into the Cellhawk application. This program allows the expert to filter location data based on accuracy, time, and location. For this portion of the analysis, I only relied on data that had an accuracy of 100M or better. The following is a summary of location events for 1/29/2022. The timing of Jennifer McCabe's search for “hos long to die in cold” has been added for reference. + 12:00:00 AM. In Proximity to the Waterfall Bar & Grill. + 12:13:46. AM_ Accuracy improves significantly and indicates leaving Waterfall + 12:18:25 AM. Arrives at the Alberts residence @ 34 Fairview. + 01:47:17 AM. Accuracy improves significantly and indicates leaving Fairview.AM. Makes a right turn onto Lawrence St, tis is the tun before Pleasant Street, which intersects with John O’Keefe’s residence. + 02s :25.AM_ Located on Leonard Way, course is reversed. + 02:12:38 AM_ Arrives at Jen McCabe residence @ 12 Country Lane. + 02:27:40 AM_ At 12 Country Lane, search “hos long to die in cold”, + 05:39:10 AM_ Leaves 12 County Lane. + 05:46:05 AM. Arrive at John O'Keefe Residence @ 1 Meadows Ave. + 05:52:45 AM. Leaves 1 Meadows Ave. = 0S: AM. In Proximity to the Waterfall Bar & Gril. AM Arrives at The Alberts Residence @ 34 Fairview. = 06: 11:16:03 AM_ Leaves 34 Fairview. + 11:22:55 AM. Arrives at Jen McCabe Residence @ 12 Country Lane, Health Data Information 17. Data obtained from the Health application on Jennifer McCabe's iPhone indicates that her device was connected to an Apple Watch on January 29, 2022, which enhances the accuracy of the health data recorded and provides for a greater amount of detail. A true and correct copy of data obtained from the Health application on Jennifer McCabe's iPhone, which was recorded on January 29, 2022, is attached hereto as “USF-08." ‘ ANALYSIS OF JOHN O°KEEFE’S IPHONE 18. Thave also analyzed the health-related data obtained from USF Evidence No. 22-989310, which isa forensic image of John O'Keefe's iPhone 11. When a user enables the application to record information, the iPhone’s operating system can record a broad range of activity and health-related data, ‘The following information was obtained from O’Keefe’s Health application between 12:00:00 a.m. and 6:00:00 a.m, on January 29, 2022, + 12:11:09 AM to 12:21:05 AM - 170 Steps, 99.6 Meters (326.77 Ft) ‘© 12:21:10 AM to 12:24:22 AM - 80 Steps, 87.74 Meters (287.86 Ft) 12:21:14 AM to 12:24:37 AM ~ Ascended / descended three floors + 12:31:56 AM to 12:32:16 AM - 36 Steps, 25.46 Meters (83.53 Ft)Notably, although the time ranges indicated above record total steps and/or elevation ducing the relevant time period, itis impossible to determine whether the steps taken and/or elevation gain was recorded during the entirety of that time period or for only a portion thereof. A true and correct copy of the analysis of O’Keefe’s Health data recovered using Axiom is attached hereto as “USF-09.” 19, I subsequently analyzed the location data associated with O'Keefe's iPhone. iPhones store ‘various location data with varying degrees of accuracy, as explained in paragraph 12 above. In order to analyze the location data associated with this case, the location data was exported into the Cellhawk application. This application allows the expert to filter based on accuracy, time, and location, For this portion of the analysis, I only relied on data that had an accuracy of 100M or better. Based on my analysis of the location data obtained on O’Keefe’s cell phone, it appears that the first location ping in the neighborhood near the Albert Residence occurred at 12:19:33 a.m, Location data indicates that O'Keefe arrived at the Albert Residence at 34 Fairview at 12:24:28 am, CONCLUSION 20. In order to properly investigate O°Keefe’s death and recover critical information surrounding ‘what transpired on January 29, 2022, and the days thereafter, I will need to obtain substantive text and/or Message communications, search history, web browsing history, location data, and/or cell phone data that ‘may have been deleted during the relevant time period by the individuals in question. Ican only obtain this information by creating a proper forensic image or extraction of the cell phones themselves (or any potential backup sources such as computers and/or cloud-storage platforms as well as synced devices such as tablets). Once I have ereated a forensic image of the device(s) and/or data, I can run various tools and conduct a forensic analysis of the information to obtain the critical information outlined above. 21. Furthermore, cell phone carriers independently maintain call detail records, including call records, SMS text and MMS records, and data usage records, cell tower and cell phone location information, and subscriber information associated with their customers. Thus, cell phone carrier records are necessary to independently establish whether any substantive communications may have been missing, deleted, or are otherwise unrecoverable using forensic tools to analyze the devices themselves. Whereas here, there is significant evidence that persons connected with this case have made attempts to delete, destroy, alter, and/or tamper with information or evidence that was tumed over to law enforcement, it is absolutely necessary that I be able to compare any data uncovered through a forensic analysis of the individuals’ devices with their corresponding cell phone carrier records (which are independentlyUSF.08 Page 01 Evidence number ‘Apple Health Steps 22-989308 iPhonedt sMcabe ypsp2022 ‘Steps Taken Start Date/Time-UTC-05:00 End Date/Time -UTC-05:00 (Minutes) ‘Model 1D 33 4/28/2022 11:58:07 PM, 1/29/2022 12:00:00 AM 188, Watehs.4 a 4/28/2022 11:58:24 PM, 4/29/2022 12:07:41 AM 9.28 ‘Phonel2,2 B 4/29/2022 12:01:08 AM 1/29/2022 12:01:11 AM 0.04 waten6.a 4 4/29/2022 12:08:26 AM 1/29/2022 12:06:18 AM 0.04 watchs 28 4/29/2022 12:05:38 AM 1/29/2022 12:06:14 AM 06 Watchs.4 16 4/29/2022 12:07:02AM 1/29/2022 12:07:26 AM 0.38 Watehs,4 154 4/29/2022 12:10:44 AM 1/29/2022 12:19:22 AM Bea ‘Phone12,1 36 4/29/2022 12:10:45 AM 4/29/2022 12:11:48 AM oa Watch6,4 57 4/29/2022 12:11:47 AM 1/29/2022 12:12:28 AM os Watchs,4 4/29/2022 12:18:50 AM 1/29/2022 12:19:46 AM oa Watch6.4 33 1/29/2022 12:2037 AM 4/29/2022. 12:21:28 AM 08s. Watehs.a 1 4/29/2022 12:23:00 AM 1/29/2022 12:23:02 AM 0.08 Watehs.a 4 2129/2022 12:25:33 AM 1/29/2022 12:25:16 AM 0.08 Watehs.4 us 2429/2022 12:35:39 AM 1/29/2022 12:45:02 AM 9.38 watchs.4 16 4/29/2022 12:41:31 AM 1/29/2022 12:43:14 AM. in |Phonel2,2 3 4/29/2022 12:48:52 AM 1/29/2022 12:48:58 AM 0.08 watehs.4 5 4/29/2022 12:52:10 AM 4/29/2022 12:52:13 AM 08 Watchs,4 4/29/2022 12:56:14 AM 1/29/2022 12:56:52 AM oa Watehs,4 28 1/29/2022 12:58:01 AM 1/29/2022 12:58:53 AM 0.86 Watché,4 26 1/29/2022 12:58:08 AM 1/29/2022 12:59:34 AM 043 watchs. 4 4/29/2022:1:01:11 AM. 4/29/2022 1.0137 AM os Watehs.a B 1/29/2022 1:03:53 AM 429/2022.1:0434 AM 06s, Watehs.4 a 4129/2022 1:05:30 AM. 4129/2022 1:06.29 AM 08 Wateh6.a 39 4/29/2022 1:06:54 AM, 4/29/2022.:07:40 AM. ov Watehs.a 8 4/29/20221.07:58 AM 429/202 1:08:18 AM 034 Watchs.4 2 2129/2022 1:09:58 AM 429/2022.1:1052 AM Watch6.4 3 429/2022.1:11.20 AM 429/2022.1:11:40 AM. Watché,a 20 4/29/2022. 1:13:33 AM 129/2022.1:13:35 AM Watchs.4 2 4/29/2022.1:15:59 AM, 1/29/2022 1:16:58 AM 08 Watehs,a 2 429/202 1:16:58 AM 429/2022.1:17:56 AM. 098 Waten6,4 19 4/29/2022 1:20:02 AM 1/29/2022.1:20:45 AM. 073 Watehé.a % 1/28/2022 1:21:49 AM 429/2022.1:22:05 AM. 026 Wateh6,4 10 1/29/2022 1:23:05 AM. 1/29/2022 1:23:16 AM. oar watchs, ass 4/29/2022 1:24:02 AM. 429/202 1:34:03 AM, 1001 Watchs,4 35 1/29/2022 1:34:02 AM 129/2022.1.43:12 AM 9.16 'Phonel2,2 35 4/23/2022 1:34:03 AM. 1/29/2022.134359 AM. ose Watehs.4 8 1/29/2022 1:35:53 AM, 1/29/20221:3555 AM. 0.04 Watens.a 302 429/2022 1:36:36 AM. 1/29/2022 1:44:28 AM, 787 Watch6,4 55 4/29/2022 1:48:08 AM, 4/29/2022 1:45:58 AM, 184 |Phonel2,2 16 4/29/2022 1:55:34 AM, 429/20221:57:48 AM, 238 'Phonel2,2 40 3/29/2022 2:13:06 AM, 4/29/2022 24:03 AM, oa ‘Phonel2,1 8 11/28/2022 2:13:20 AM 4/29/2022 2:14:06 AM. o7 Watch6.4 a 4/29/2022 2:14:49 AM, 1/29/2022 2:15:33 AM 073 Watehs.4 8 3/29/2022 2:15:48 AM. 1/29/2022 21634 AM. o7 Watchs.4 38 11/28/2022 2:16:50 AM 4/29/20222:17:48 AM, 08 Watch6.a 16 4/29/20222:1753 4M. 1/29/2022 2:18:32 AM oa Watch6,4 6 4/29/2022 2:18:57 AM. 29/2022 29:23 AM 02 watens.a 38 429/20222:20:14 AM 4/29/2022 2:23:10 AM oa waten6a a 1/23/2022 2:21:38 AM. 429/2022222:11 AM 055 Watens,41 re 2 24 4 10 2 2 95 55 8 3 104 24 2 a ey 20 6 cy 38 2 190 7 2 2 2 2 33 10 Hgeon 2 59 32 7 1/29/2022.2:22:42 AM 1/23/2022 2:23:19 AM 1/2/2022 23213 AM 4/23/2022 35038 AM 1/29/2022 3:51:40 AM 4/29/2022 4:55:07 AM, 1/29/2022 5:00:58 8M 1/23/2022 5:26:56 AM, 1/23/2022 5:28:23 AM 1/29/2022 5:28:27 AM 4/29/2022 5:31:19 AM 4/29/2022 5:32:56 AM 4/29/2022 5:33:55 AM 1729/2022 5:47:27 AM 4/23/2022 5:51:52 AM 1/28/2022 6:03:23 AM 1729/2022 60824 AM 4/29/2022 6:08:27 AM 1/28/2022 6:05:43 AM 11/28/2022 6:08:45 AM. 1/29/2022 6:10:53 AM 1/28/2022 6:12:10 AM 11/29/2022 6:12:58 AM 4/29/2022 6:19:07 AM 4128/2022 6:26:20 AM 1/29/2022 62727 AM 429/20226:28:25 AM 429/202 6:32:33. AM 1/28/2022 6:38:32 AM 1/28/2022 6:38:59 AM 4/23/2022 6:41:02 AM 1/29/2022 6:47:27 AM 1/29/2022 7:00:38 AM 123/202 7.0016 AM 1/23/2022 7:30:45 AM 1128/2022 7:43:08 AM 1/29/2022 8:02:53 AM 41/23/2022 8:23:43 AM 1/28/2022 8:26:42 AM 1/29/2022 8:32:56 AM 4/29/2022 8:34:36 AM 1/29/2022 8:36:14 AM 1/29/2022 8:39:54 AM 1/29/2022 8:39:59 AM. 1/29/2022 8:41:37 AM 1/29/2022 8:46:31 AM 1/2/2022 8:48:22 AM 1/23/2022 8:48:31 AM 4/23/2022 9:08:34 AM. 1/29/2022 9:23:35 AM. 1/23/2022 9:36:48 AM. 1/2/2022 9:54:14 AM 1/29/2022 10:05:28 AM 1/29/20222:23:20 AM 1/29/2022 2:31:88 84 4/29/2022 233:07 AM 4/29/2022 3:51:37 AM 1/29/2022 3:51:45 AM 1/29/2022 5:01:09 AMA 1/29/2022 5:01:09 AM 1/29/2022 5:27:03. AM 1/29/2022 5:28:22 AM 1/29/2022 5:34:50. AM 1/29/2022 5:32:03 AM 11/29/2022 533:0 AM 1/29/2022 5:36:36 AM 1/29/2022 5:52:01 2M 4/29/2022 5:55:53 AM 1/29/2022 6303:59 AM 4/29/2022.62:16 AM 1/29/2022 6:08:29 AM 1/29/2022 6:05:46 AM. 1/29/20226:10:10 AM 1/29/2022 6:11:29 AM. 1/29/2022 62:13 AM 1/29/2022 6:17:50 AM, 1/29/2022 6:26:28 AM 41/29/2022 6:26:56 AM 1/29/2022 6:28:00 AM. 1/29/20226:36:52. AM 129/2022.6:38:58 AM, 1/29/20226:39:03. AM, 1/29/2022 6:40:11 AM 4/29/2022 6:41:33 AM 1/29/2022 64737 AM 1/29/2022 7-02:47 AMA 4/29/2022. 7:00:23 AM 1/29/2022 7:30:58 AM 4/29/2022 7:44:51 AM. 1/29/2022 8:03:01 AM. 1/29/2022 8:23:50 AM 4/29/2022 8:26:52 AM. 4/29/2022 8:32:59 AM. 4/29/2022 8:34:39 AM. 4/29/2022 8:36:29 AML 1/29/2022 80:02AM 4/29/2022 8:40:02 AM 1/29/2022 8:41:44 AM. 1/29/2022.8:46:33 AM 1/29/2022.8:48:28 AM 1/29/2022 8:50:27 AM 1/29/2022 9:09:36 AM 1/29/20229:24:14 AM. 1/29/2022 9:41:08 AM. 1/29/2022 10:03:28 AM 11/29/2022 10:06:40 AM oss 843 ry 0.98 0.09 6.03 oa7 033 098 638 on ox 268 456 06 787 os 0.04 043 6 08 4.86 736 06 oss 3.45 6a ost 02 ost oa7 248 on 021 173 033 013 oa7 008 00% 026 033 4 023 0.04 08 094 0.08 064 427 923 9 USF-08 Page 02 Wwatchs,4 iPhone Watchsa Watchs,6 Watch6.4 iPhonet22 watchs, Watch6,4 watchs IPhone12.2 Watehs,¢ Watcho,a Watchs,¢ Watchs,4 'Phonel2a Watchs,4 |Phonen2.a Watchs,¢ Warch6,4 Wateh6,4 Wateh6,¢ Warcho,e Waten6,e |Phonei2t Watch6,4 Wateh6,4 watchs, IPhonel2a Watch, Watch64 Watch Warch6,4 'Phonen2,2 Watch6,¢ Watehs.4 Watehs,4 Watehs.4 Watchs.4 Wateho,4 Watehs,¢ Watchs,4 Watcho,« 'Phonel2.2 Watchs,¢ Watchs,¢ Watch6,4 Waten6,¢ Watch6,4 Watch6,¢ watchs, Wateho,4 Watch6.4 watchs,Fa 36 Pn 1 a 7 20 3 36 1 3 10 25 6 4/29/2022 10:32:21 AM 1/28/2022 10:42:27 AN: 1/28/2022 10:42:30 AM 3/29/2022 10:52:43 AM, 1/29/2022 1:11:43 AM 1/29/2022 11:23:21 AM 1/23/2022 11:59:04 AM 1/28/2022 25627 PM. 11/29/2022 3:08:20 PM 1/29/2022 3:19:02 PM, 1/29/2022 3:43:07 PM, 1/2/2022 3:58:03 PM. 1/23/2022 4:38:14 PM, 1/29/2022 5:34:48 PM. 1/29/2022 9:14:16 PM, 4/29/2022 8:25:52 PM, 1/29/2022 9:42:08 PM 1/29/2022 11:39:34 PM 4/29/2022 10:32:27 AM 41/29/2022 10:50:20 AM 4/29/2022. 10:43:31 AM 1/29/2022 10:57:54 AM 4/29/2022 11:32:19 AM 129 /2022.1:31:00 AM 1/29/2022 12:01:38 PM 4/29/2022 2:56:23 PM. 1/29/2022 3:18:16 PM 4/29/2022 1y29/2022 1/29/2022 1/29/2022 4:38:67 PM. 4/29/2022 5:34:58 PM. 129/202209:19:32 PM 1/29/2022 9:26:46 PM. 4/29/2022 9:42:28 PM. 1/29/2022. 13:43:07 PM 0.09 787 102 5.18 06 7.66 2.56 04 9.93 0.09 9.46 0.08 056 oa7 5.26 ry 034 154 USF.08 Page 03 Waich6.4 IPhonet2.a watch6,¢ iPhonel2.a Phonei2,2 ‘Phonet2,1 Phonei2, ‘hone? ‘hone12,1 Phonet2,1 honed2,1 ‘Phonel2,1 ‘Phonet2,2 ‘hone12,1 ‘Phonet2,1 Phonel2,2 ‘honet2,21 honet2,2USF-08 Page 04 Evidence number ‘Apple Health Distance 22.989306 iPhone21 JMcabe 292022 (Meters) Start Date/Time -UTC-05:00 End Date/Time-UTC-05:00 (Minutes) Model 1D 47.08 1/28/2022 11:58:24 PM 4/29/2022 12:07:41 AM 9.28 Phonel2.2 25.63 1/2/2022 21:59:39 PM 5/29/2022 12:00:00 aM 034 watcha 918 1129/2022 12:01:08 AM 4/29/2022 12:01:11 AM 0.08 Watch6.4 2a 12972022 32:08:16 AM 4/29/2022 12:06:18 AM. 02 Watchs 2036 4/29/2022 12:05:38 AM 4/29/2022 12:06:14 AM os Woatch6,4 1081 4129/2022 12:07:02 AM 4/29/2022 12:07:26 AM, 038 watchs 230 1/29/2022 32:10:45 aM 4/29/2022 12:11:48 AM, 058 watchs, 11034 14/29/2022 32:10:44 AM 1/29/2022 12:19:22 AM, 864 IPhonet2,3 40.36 1429/2022 32:11:47 AM 4/29/2022 12:12:28 AM, 0.68 watch64 Baa 1/29/2022 32:18:50 AM 4/29/2022 12:19:46 AM, 038 watehéa 26.66 1/29/2022 32:20:37 AM 3/29/2022 12:21:28 AM, 08s, Watch64 on 1/29/2022 12:23:00 AM 4/29/2022 12:23:02 AM, 0.08 Watch64 30 1/29/2022 12:25:13. AM 4/29/2022 12:25:16 AM, 008 watchs 10551 4/29/2022 12:35:39 AM 4/29/2022 12:45:02 AM, 938 Watch64 233 1/29/2022 12:48:52 AM 1/29/2022 12:48:58 AM, 0.08 watchs 358 1/29/2022 12:52:10 AM 4/29/2022 12:52:13 AM, 0.08 Watch 112 12/2022 12:41:31 AM 1/29/2022 12:43:14 AM, an iPhonet2.3 448 1/29/2022 12:56:14 AM 41/29/2022 125652 AM, 068 Watch6,6 235 1/29/2022 1258-01 AM 3/29/2022 12:58:53 AM 086 Watch64 1839 1/29/2022 12559:08 AM 1/29/2022 12:59:34 AM, 03 Watch64 92a 1/29/2022 10353 AM 1/29/2022 10434 AM 088 Watcha 3473 1/29/2022 1:05:30 AM 1/29/2022 1.0628 AM. 098 Watché4 3126 1129/2022 10654 AM 4/29/2022 107:40 AM. 077 Watch6,4 10.05 12972022 1:01:11 AM 1/29/2022 10137 AM, 03 Watch6.4 an 1/29/2022 10758 AM 11/23/2022. 108:18 AM. 03a watch6,4 a8. 4/29/2022 10958 AM 1/29/2022 1:1052 AM 089 Watch6.6 26.02 4292022 11120 AM 1/29/2022 4:14:40 AM. 03a Watch6a 698 4/29/2022 15133 AM. 1/29/2022 1:13:35 AM 08 Watch6,6 708, 4/29/2022 1:35:59 AM 1/29/2022 3:16:09 AM 017 Watch6,4 1637 4/29/2022 1:16:32 AM 1729/2022 3:17.00 AM 047 watehs.4 638 2429/2022 1:17.05 AM 1/29/2022 1:37:10 AM, 0.09 Watch6.4 638 2429/2022 1:1751 AM 1/29/2022 17:56 AM 0.08 Watché.¢ 1359 4297202212002 AM 12972022 120045 AM ona Watch6,a 1995 4/29/2022 1:21:48 AM. 1/29/2022 122:05 AM 026 Watchs.4 709 42972022 1:23:06 AM 1/29/2022 123:16 AM 017 Watch6,¢ 187.09 4/29/2022 1:2402 AM. 1/29/2022 13403 AM. 1001 Watché,¢ 2383 4/29/2022 1:3402 AM 1/29/2022 1:43:12 AM 9.6, ‘Phonet2t 26.88 1/28/2022.134:03 AM 1/29/2022 13459 AM 08a watch6,4 594 2/28/2022.135:53 AM 1/29/2022 2:35:55 AM. 0.08 watchs, 105 4/29/2022 1:36:35 AM. 4/29/2022 13656 AM 034 watchs, 15.24 4/29/2022 1:37:08 AM. 4/29/2022 13732 AM. 038 watchs. 2046 1/2/2022 137:45 AM 1/29/2022 2:38:13 AM. oa? Wwatch6,4 2041 4/29/2022 1:38:15 AM 1/29/2022 13841 AM. aa Watch6,4 2667 4/29/2022 1:38:46 AM 1/29/2022 1:39:17 AM ost Watch6,4 3085 4/29/2022 1:38:17 AM 1/29/2022 13947 AM. ost Watch6,4 2738 1/29/2022 1:38:47 AM. 1/29/2022 1:40:15 AM oa? Watch6.4 1365 4/29/2022 1:40:18 AM 1/29/2022 1:40:48 AM ost Watehs,4 134 1/29/2022 1:40:53 AM 1/29/2022 1:41:16 AM 038 Weatch6,4 a 1/28/2022 4:42:27 AA 1/29/2022 4:42:28 AM. 0.04 Wateho,4 045 4/29/2022 1:41:38 AM. 1/29/2022 14428 AM. 2a1 Watch6,44202 3357 3003 538 312 567 2a24 133 955 278 1638 3353 34.02 1599 14 489 205 723 1075 39.75 21.26 69.54 13.43 42.46 647 16.78 2002 01 425, on 208 355 238 45.77 2235 2459 751 150.76 13496, 21.78 v0 2221 5.7 wan 1636 1595 2307 65s. 746 18.43 1134 7.09 1627 on 1/29/2022 1:44:08 AM 4/29/2022 1:55:34 AM 1/29/2022 2:13:06 AM. 1/29/2022 2:13:20 AM 4/29/2022 2:14:49 AM, 1/29/2022 2:15:48 AM 1/29/2022 2:16:50 An 1/29/2022 2:1753. AM, 1/29/2022 2:18:57 AM, 1/29/2022 2:20:14 AM, 1/29/2022 2:21:38 AM, 1/29/2022 2:22:82 AM, 2129/2022 2:23:19 AM, 1/29/2022 232:13 AMA 1/29/2022 3:50:38 AM, 1/29/2022 3:51:40 AM, 1/29/2022 455.07 AM, 1/29/2022 5:00:58 AM, 1/29/2022 5:26:56 AM 4129/2022 533118 AM. 1/29/2022 5:28:23 AM, 1/29/2022 5:28:27 AM, 1/29/2022 53256 AM, 4/29/2022 5:33:55 AM 4129/2022 5:47:27 AM 4/29/2022 55152 AM 4/29/2022 6:03:23 AM 1/29/2022 60424 AM. 1/29/2022 6:04:27 AM 1/29/2022 6:05:43 AM. 1/29/2022 6:09:45 AM. 1/29/2022 6:10:53 AM 12972022 6:12:10 AM 1/29/2022 6:12:58 AM 1/29/2022 6:19.07 AM 1/29/2022 6:26:20 AM. 4/29/2022 627.27 AM 1/23/2022 6:28:25 AM 4/29/2022 63233 AM 1/29/2022 638.32 AM 4/29/2022 6:38:55 AM. 4/29/2022 6:42:02 AM. 4/29/2022 6:47:27 AM 4/29/2022 7:00:36 AM. 4/23/2022 7:00:18 AM. 4/29/2022 7:30:45 AM. 4/29/2022 7:43:04 AM 4/29/2022 80253 AM 1/29/2022 8:23:43 AM. 1/29/2022 8:26:42 AM. 1/29/2022 8:32:56 AM 1/29/2022 8:34:36 AM. 1/29/2022 8:36:14 AM 1/29/2022 8.3959 AM. 1/29/2022 14558 AM 1/29/2022 157:44.4M, 1/29/2022 23403 AM, 1/29/2022 2:1406 AM, 4129/2022 2:1533 AM, 1/29/2022 2:1634 AM 1/29/2022 21748 AM, 1/29/2022 2:1832 AM 1/29/2022 2:18:23 AM 4/29/2022 2:21:10 AM 4429/2022 2:22:11 AM 4/29/2022 2:23:20 AM 1/29/2022 2531:44 AM. 4/29/2022 2:33:07 AM 1/29/2022 351:37 AM 1129/2022 35145 AM 12972022 5:90:09 AM. 1129/2022 501.09 AM, 1/29/2022 5:27.03 4M. 1729/2022 533203 AM 2129/2022 5:23:22 AM 1/29/2022 53450 AM 1/29/2022 5:33:04 AM, 1/29/2022 5:36:36 AM. 4/29/2022 5:52:01 AM. 1/29/2022 55553 AM. 4/29/2022 6:03:59 AM, 1129/2022 6:12:16 AM. 1/29/2022 6:04:29 AM. 1129/2022 6:05:46 AM, 1129/2022 6:10:10 AM 1129/2022 6:11:28 AM. 4/29/2022 6:12:13 AM. 1129/2022 6:37:50 AM 1/29/2022 626.28 AM 1/29/2022 626:56 AM 1/29/2022 6 28:00 AM 1/29/2022 6:36:52 AM 11/29/2022 638:58 AM 1/29/2022 639.03 AM. 1/29/2022 6:40:13 AM 1/29/2022 6:41:33 AM. 1129/2022 6:47:37 AM 1/29/2022 70028 AM 11/29/2022 792:47 AM. 4/29/2022 73058 AM. 4/29/2022 7:4451 AM 3/29/2022 603:01 AM 11/29/2022 8:23:50 AM 1/29/2022 82652 AM. 1/29/2022 8:32:59 AM, 1/29/2022 83439 AM, 1/29/2022 8:36:29 AM. 1/29/2022 8:40:02 AM. ry 238 096 o7 073 o7 098 064 oa 094 055 068 2843 09 098 0.09 603 oa7 013 on 098 638 043 268 456 402 06. 737 08 8 043 06 0.04 4.36 736 os oss. 84s, 6.2 ost oat osa 017 021 248 oat 179 013 033 oa7 0.04 0.04 026 0.08 USF.08 Page 05 iPhonen2.1 'Phone32.2| Phone Watens.4 watehs.4 Watehé,4 Watché.4 Watehs.4 Wwetchs,a Watchs,4 Watch6,a weeehs,4 ‘Phone watch6.4 Watch6,4 Watch6.4 Phonet2,1 Watchs,¢ watchs. 4 Watch6.6 Watch6.6 'Phonei2a Watch6,4 Watch6,4 Waten6,4 ‘Pronel2a Watehs,¢ ‘Phoned Waten6,¢ Weatch6,¢ Watch6,¢ Watch6,¢ watche,¢ Watch6,a Phonel2.1 Watchs.4 Watch6,4 Watchs.4 ‘Phones Wwatch6,6 Watcha Watch6,4 Watch6.4 Watch66 Phonei2.3 Watch64 watchs Watch6 watcha Watcha Watcha Watch64 Watch64 watchs10.08 1022 567 567 12.78 on 22.88 aa7 2097 2737 992 25.83 991 nz 3498 5877 3495 52 57.36 158 49.4 768 aur 163 1597 347 1895 430 129/2022839:54 AM. 4/29/2022 8:41:37 AM. 4/29/2022 8:46:11 AM. 4/29/2022 8:48:22 AM. 4/29/2022 8:49:31 AM. 1/29/2022 9:09:34 AM 1/29/2022 9:23:35 AM 41/29/2022 8:36:48 AM 4/29/2022 9:54:14 0M 3/29/2022 10:05:28 AM 9429/2022 10:32:21 AM 4129/2022 10:42:27 AM 1/28/2022 10:42:30 AM 4/23/2022 10:52:03 AM 2429/2022 11:11:43 AM 41/29/2022 11:23:21 AM 4/29/2022 1159108 AM 4/29/2022 2:56:27 PM 1/29/2022 3:08:20 PM 1/29/2022 3:18:02 PM 1/28/2022 3:48.07 PM, 4/23/2022 3:58:03 PM 4/29/2022 438:14 PM 1/23/2022 5:34:48 PM, 4/29/2022 9:14:16 PM 1/23/2022 8:25:52 PM, 4/29/2022 9:42:08 PM 1/29/2022.11:38:34 PM 1292022 840.02 AM. 1/29/2022 6:41:48 AM. 1/29/2022 8:46:13 AM 1129/2022 8:48:24 AM, 1/29/2022 85027 AM 1129/2022 9:09:36 AM. 12972022 82414 AM, 1129/2022 941:08 AM 1/29/2022 10:03:28 AM 2/29/2022 10:06:40 AM 4/29/2022 10:32:27 AME 4/29/2022 10:50:20 AM 11/29/2022 10:43:31 AM 1292022 10:57:54 AM 1292022 12:12:19 AM 4/29/2022 11:31:00 aM 1/29/2022 12:01:38 PM, 1/29/2022 25629 PM, 1129/2022 3:38:16 PM. 1/29/2022 3:39:07 PM. 1129/2022 352:34°M, 1/29/2022 358.06 PM. 1129/2022 43847 8M, 1/29/2022 53458 eM, 1/29/2022 99:32 PM. 1/29/2022 82646 PM. 1/29/2022 9:42:28 PM. 11/29/2022 11:41:07 PM, 013 03 0.08 0.08 094 0.04 064 427 923 119 0.08 737 102 518 os 76 256 08 993 0.09 9.46 0.04 036. 017 5.26 03 oa 154 USF.08 Page 06 'Phones2.1 Watche,¢ Watchs.4 watchs. Watchs.4 watchs.4 Watch6,¢ Watch6,4 Wateh6,4 watchs,4 Watch6,4 'Phonen2.1 Watchs.4 ‘Phonel2a ‘Phones2a ‘Phonen2.a ‘Prone12 ‘Phones? 'Prone321 |Phonei2.1 Phonet21 ‘Phonei21 ‘Phonei21 ‘Phones2.1 ‘Phones22 ‘Phone12a ‘Phone122 Phonei21Evidence number 22-989304 iPhonel1 JMcabe Heart Rate Start Date/Time - UTC-05:00 39.0 96.0 83.0 66.0 700 70 850 750 86.0 B10 78.0 B40 86.0 B10 76.0 Ro 70.0 66.0 no ne no Bo no 679 66.0 68.0 67.0 no Ro no ne 70.9 709 78.0 730 70 70 73.9 800 840 84.0 840 840 240 1/29/2022 12:02:27 AM 1/29/2022 12:10:27 AM 1/29/2022 12:18:10 AM 1/29/2022 12:49:34 AM 1/29/2022 12:55:38 AM 1/29/2022 1:02:08 aM 1/29/2022 1:17:25 AM 4/29/2022 1:29:50 AM 1/29/2022 1:46:57 AM 4/29/2022 1:51:02 AM 1/29/2022 1:56:28 AM 1/29/2022 2:05:03 AM 1/29/2022 1:59:54 AM 1/29/2022 2:10:09 AM 1/29/2022 2:28:47 AM 1/29/2022 2:30:28 AM 1/28/2022 2:37:04 AM 1/29/2022 2:40:25 AM 1/29/2022 2:43:57 AM 1/29/2022 2:46:52 AM 1/29/2022 2:49:59 AM 1/29/2022 2:54:13 AM 1/29/2022 2:59:34 AM 1/29/2022 3:04:58 AM 31/29/2022 3:09:10 AM 1/29/2022 3:15:47 AM 1/29/2022 3: 4/29/2022 1/29/2022 3:30:30 AM 4/29/2022 3:34:16 AM 1/29/2022 3:39:13 AM 41/29/2022 3:43:15 AM 41/29/2022 3:44:20 AM 1/29/2022 3:52:54 AM 1/29/2022 3:53:27 AM 1/29/2022 3:56:01 AM 1/29/2022 3:59:33 AM 41/29/2022 4:04:59 AML 41/29/2022 4:09:05 AM! 41/29/2022 4: 4/29/2022 1/29/2022 4:27:15 AM 1/29/2022 4:33:07 AM 1/29/2022 4:35:15 AM ‘Apple Health Heart Rate 29/2022 End Date/Time - UTC-05:00 1/29/2022 12:02:27 AM 1/29/2022 12:10:27 AM 1/29/2022 12:15:10 AM 1/29/2022 12:48:34 AM 1/29/2022 12:55:38 AM 1/29/2022 1:02:08 AM, 1/29/2022 1:17:25 AM 3/29/2022 2:29:50 AM 1/29/2022 1:46:57 AM, 1/29/2022 1:51:02 AM 1/29/2022 1:56:28 AM 1/29/2022 2:05:03 AM. 1/29/2022 1:59:54 AM 1/29/2022 2:10:09 AM. 1/29/2022 2:28:47 AM, 1/29/2022 2:30:28 AM 1/29/2022 2:37:08 AM, 1/29/2022 2:40:25 AM 1/29/2022 2:43:57 AM, 1/29/2022 2:46:52 AM. 1/29/2022 2:49:59 AM 1/29/2022 2:54:13 AM. 1/29/2022 2:59:34 AM 1/29/2022 3:04:59 AM. 1/29/2022 3:09:10 AM 1/29/2022 3: 1/29/2022 3:19: 3/29/2022 3:27:07 AM 41/29/2022 3:30:30 AM 1/29/2022 3:34:16 AM 1/29/2022 3:39:13 AM 1/29/2022 3:43:15 AM 1/29/2022 3:44:20 AM. 1/29/2022 3:52:54 AM 1/29/2022 3:53:27 AM 1/29/2022 3:56:01 AM 1/29/2022 3:59:33 AM 1/29/2022 4:04:59 AM 11/29/2022 4:09:05 AM 1/29/2022 4:14:35 AM 1/29/2022 4:20:11 AM 1/29/2022 4:27:15 AM 1/29/2022 4:33:07 AM UsF.08 Unit ccount/min ccount/min ‘count/min, count/min ‘count/min ‘count/min ‘count/min ccount/min ‘count/min ccount/min ‘count/min ccount/min ‘count/min ccount/min ‘count/min ccount/min ccount/min ccount/min ccount/min ccount/min ccount/min ccount/min ccount/min ccount/min ccount/min ccount/min ccount/min, count/min ccount/min ccount/min count/min ccount/min count/min ccount/min ccount/min ‘count/min ccount/min ccount/min, ccount/min count/min count/min Page 07 Model 1D Watch6,4 Watch6 4 Watch6 4 Watch6 4 Watch6 4 Watch6 4 Watch6,4 Watch6 4 Watch6,4 watch6,4 Watch6 4 Watch6,4 Watch6.4 Watch6 4 ‘Watch6 4 Watch6 4 Watch6 4 Watch6 4 Watch6 4 Watch6,4 Watch6 4 Watch6 4 Watch6 4 Watch6 4 Watch6 4 Watch6 4 Watch6 4 Watché Watch6 4 Wateh6 4 Watché 4 wateh6 4 Watch6 4 Watch6 Watch6 4 Wateh6 4 Watch6 4 Watch6 4 Watch6 4 Watch64 Watch6 4 Watch6,4 Watch6,4 Watchs,496.0 95.0 99.0 101.0 89.0 39.0 970 90.0 840 85.0 910 860 910 91.0 97.9 89.0 93.0 1/29/2022 9:43:35 AM 1/29/2022 9:47:54 AM 1/29/2022 9:53:54 AM 1/29/2022 9:55:57 AM 1/29/2022 10:00:53 AM 1/29/2022 10:07:45 AM 1/29/2022 10:21:55 AM 4/29/2022 10:24:05 AM 1/29/2022 10:30:29 AM 1/29/2022 10:38:15 AM 1/29/2022 10:39:52 AM 1/29/2022 8:12:18 AM 1/29/2022 8:30:25 AM 1/29/2022 8:05:17 AM 4/29/2022 8:18:08 AM 1/29/2022 9:43:35 AM 1/29/2022 9:47:54 AM 1/29/2022 9:53:54 AM 1/29/2022 9:55:57 AM 1/29/2022 10:00:53 AM 1/29/2022 10:07:45 AM 1/29/2022 10:08:16 AM 1/29/2022 10:18:21 AM 1/29/2022 10:21:55 AM 1329/2022 10:24:05 AM 1/29/2022 10:30:29 AM 1/29/2022 10:38:15 AM 1/29/2022 10:39:52 AM 1/29/2022 8:12:18 AM 1/29/2022 8:05:17 AM 1/29/2022 8:18:08 AM USF-08 ccount/min ccount/min ‘count/min ‘count/min ccount/min ‘count/min ccount/min ccount/min ccount/min ccount/min ‘count/min ccount/min ‘count/min ccount/min ccount/min ccount/min ccount/min Wateh6,4 Watch6,4 Watché,4 Watch6 4 Watché 4 Watch6 4 Watché 4 Watch6 4 Watch6 4 Watch6 4 Watch6 4 Wateh6 4 Watch6,4 Watché 4 Watché 4 Watch6 4 Watché 4USF.09 Page 01 Evidence number ‘Apple Heath stops 22989310 Phone11 JOkeefe sypapioz2 Stops Taken Start Date/Time-UTC-05:00 End Date/Time -UTC-05:00 (Minutes) ‘Model 1D 70 12972022 2:11.09 AM 2/25/2002. 12:23:05 AM 295, ‘Phoner2.1 0 1/29/2022 12:21:10 AM 1/25/2022 12:28:22 AM 39 'Phone12.1 36 1/29/2022 12:31:56 AM 1/25/2022 12:32:16 AM 03a ‘Phone 12.1 a2 1/29/20226:08:01 AM 2/28/2022 6:11:30 AM, 748 'Phonet2.1 10 1297202265:14 AM 1/25/2022 6:21:21. AM, 62 'Phonet2.4 ws 1/29/2022626:17 AM 1/25/2022 6:34:44 AM, as, Phonet2.1 192 129/2022636:16 AM, 1/25/2022 6:43:39 AM, 705 'Phonex2.1 208 129/2022655:05 AM 2/28/2022 729446 AM, 3.69 |Phones2,1 v9 1123/2022 705:09 Am, 1/25/2022 7:14:48 AM, 968 'Phonet2.4 205, 1/29/2022 76:43 AM, 3/25/2022 7:23:35 AM. 588. 'Phone 12.3 2 1123/2022 730:16 AM, 1/28/2022 73185 AM 14s 'Phone22.1 164 1/29/2022 72:10 AM, 1/28/2022 75204 AM, 99 'Phonet2,1 23 11/29/2022 8:08.00 AM, 1/28/2022 8:11:39 AM, 331 'Phonet2,3 oe 1/29/20228:25:18 AM, 1/28/2022 8:26:37 AM, 132 'Phonex2.1 a 1/29/2022 75743 AM, 1129/2022 8972.2 965 'Phonet2.1 a 1/23/2022.1:06-08 AM 3/25/2022 11:11:06 AM 497 'Phone 12.1 103, 1/29/2022 11:18:48 AM 3/28/2022 13:20:07 AM 132 'Phones2.1 6 129/2022.11:56-01 AM 1/25/2022 13:56:45 AM on [Phonet2,1USF-09 Page 02 Evidence number ‘Apple Heath Distance 22969510 Phonelt JOkeete rasp (Meters) Start Date/Time - UTC-0% End Date/Time - UTC-05:00 (miutes) Model 10 336 97202 1221994 42972022 122195 90 995 Phoned 25.06 2/2022 1231364 29/202 123236 00 038 ‘Phones2.2 out 42972022 60403 AM 372972022 61130 AM, 738 ‘Phones2.1 mss 17292022 6:15:34 AM 372972022 62123 AM sa Phoned i669 129720262617 aM 27297202 63446 AM, as Phone mea 1129/2022636.36 AM 37972022 64339 AM 705 Phonet2 aos 12972022 655.05 AM 72972022 79846 AM 969 Phoned? vane 42972022 7.05.09 aM ps7on2 71488 AM, 96 Phonet2.1 2974 7297002 7.1648 AM 3797022 72336AM, as ‘Phones2.1 mass 1729720227306 AM ans7022 73485 AM 129 Phonet2.1 sf 1221300 afasfn2 122422 0 313 ‘Phonet2.1 5334 1Y9f022 7503 AM 2/39/2022 80722 AM, 355 Phones. sna 1297202 808.00 AM 2972022 831119 AM 331 Phoned? 301 29/2022 8:25:18 AM 3/29/2022 82637 AM, 12 iPhone2 sass y9p022 1106084 272972022 111195 A 97 Phoned? 701 Yas 11:18:48 aM, 12372002 13:2007 ata a3 Phonet21 56 97002 115601 AM 27297002 115645 A a7 ‘Phones2.1 e395 97002 742:30M 12372022 75204AM 89 Phonet2Evidence number 22-989310 [Phoned JOkeefe Floors Start Date/Time - UTC-05:00 1/29/2022 12:22:14 AM, 1/28/2022 6:43:31 AM 1/29/2022 7:58:11 AM 4/29/2022 826:13 AM 1/29/2022 11:19:49 AM, ‘Apple Health Floors 29/2022 End Date/Time - UTC-05:00 1/29/2022 12:26:37 AM. 1/29/2022 6:55:05 AM 1/29/2022 78:33 AM 1/29/2022 8:26:21 AM 1/28/2022 11:19:52. AM, USF.09 Page 03 Model 1D ‘Phonet2.1 ‘honet2,1, ‘honei2.2 Phonet2.1 honet2,1840 B40 800 97.9 81.0 80.0 73.0 840 840 83.0 99.0 97.9 95.0 940 910 120 1210 1.0 119.0 115.0 100.0 95.0 94.2 94.0 97.0 99.0 960 90.0 92.0 90.9 95.0 93.0 930 93.0 990 97.0 100.0 940 88.0 98.0 98.0 102.0 100.0 100.0 108.0 105.0 106.0 98.0 1020 1/29/2022 4:41:03 AM. 1/29/2022 4:44:23 AN. 1/29/2022 4:48:57 AM 31/29/2022 4:54:49 AM 41/29/2022 5:02:14 AM 3/29/2022 5:07:11 AM 11/29/2022 5:10:22. AM 1/29/2022 5:16:45 AM 1/29/2022 5:19:01 AM 1/29/2022 5:25:49 AM 1/29/2022 5:38:14 AM 1/29/2022 5:41:45 AM 1/29/2022 5:43:57 AM 1/29/2022 5:55:36 AM 1/29/2022 6:02:02 AM 1/29/2022 6:42:59 AM 1/29/2022 6:48:40 AM 1/29/2022 63:25 AM 1/29/2022 6:58:12 AM 41/29/2022 7:03:54 AM 1/2/2022 7:08:32 AM 1/29/2022 7:13:06 AM 1/29/2022 7:13:22 AM, 1/29/2022 7:16:25 AM 1/29/2022 7:22:21 AM. 29/2022 1/29/2022 1/29/2022 7:35:43 AM. 1/29/2022 7:43:30 AM 1729/2022, 13/29/2022 7: 1729/2022 1/29/2022 7:56:07 AM 1/29/2022 8:02:25 AM, 1/29/2022 8:22:24 AM, 1/29/2022 8:40:55 AM, 1/29/2022 8:52:17 AM, 1/29/2022 8:28:01 AM, 1/29/2022 8:45:19 AM 41/29/2022 8:57:45 AM, 1/29/2022 8:59:01 AM, 1/29/2022 9:07:17 AM 1/29/2022 9:13:07 AM 1/29/2022 9:14:46 AM, 4/29/2022 9:22:01 AM. 4/29/2022 9:26:31 AM 1/29/2022 9:31:31 AM 1/29/2022 838.34 AM 1/29/2022 9:34:36 AM. 1729/2022 4:41:03 AM, 1/29/2022 4:44:23 AM. 1429/2022 4:48:57 AM, 14/29/2022 4:54:49 AM, 1/29/2022 5:02:14 AM 1729/2022 5:07:11 AM 1/29/2022 5:10:22 AM, 1/29/2022 5:16:45 AM 1/29/2022 5:19:01 AM. 1/29/2022 5:38:14 AM 1/29/2022 5:41:45 AM. 1/29/2022 5:43:57 AM 1/29/2022 5:55:36 AM 1/29/2022 6:02:02M 1/29/2022 6:42:59 AM 1/29/2022 6:48:40 AM. 1/29/2022 7: 3/29/2022 7:1 3/29/2022 7:16:25 AM. 1/29/2022 7:22:21 AM 4/29/2022 7: 1/29/2022 7: 11/29/2022 7:35:43 AM 1/29/2022 7:43:30 AM. 4/29/2022 7:46:14 AM. 1/29/2022 7:46:14 AM 41/29/2022 7:53:19 AM 1/29/2022 7:56:07 AM 1/29/2022 8:02:25 AM 1/28/2022 8:22:24 AM 1/29/2022 8:40:55 AM 1/28/2022 8:52:17 AM 1/29/2022 8:28:01 AM 1/29/2022 8:45:19 AM 1/29/2022 8:57:45 AM 1/29/2022 8:59:01 AM 1/29/2022 9:07:27 AM 1/29/2022 9:13:07 AM 1/29/2022 9:16:46 AM 1/29/2022 9:21:01 AM 1/29/2022 9:26:31 AM 3/29/2022 9:31:31 AM 1/29/2022 8:38:34 AM 1/29/2022 9:34:36 AM usF-08 ‘count/min ‘count/min ccount/min ‘count/min ‘count/min ‘count/min ‘count/min ‘count/min ‘count/min ‘count/min ‘count/min ‘count/min ‘count/min ‘count/min ‘count/min ccount/min ‘count/min ccount/min ‘count/min, ‘count/min ‘count/min, ‘count/min ‘count/min ccount/min ‘count/min ccount/min ccount/min count/min ccount/min ccount/min ccount/min, ccount/min ccount/min, ccount/min ccount/min count/min count/min count/min count/min count/min count/min ccount/min count/min ccount/min ccount/min count/min count/min count/min ‘count/min Page 08 Watché 4 Watch .4 ‘Watch6, Watch6,4 ‘Watch6 4 ‘watch ,4 ‘Watch6 4 ‘Watch6,4 Watch6 4 ‘Watch6 4 Watch6,4 ‘watch6,4 ‘watch6,4 ‘Watch Watch6 4 Watch Watch6 4 Watch6,4 Watch6,4 Watch6,4 Watché Watch6 4 Watch6 4 Watch6,4 Watch6 4 Watch6 4 Watch6,4 Watch6 4 Watché 4 Watch6 4 Watch6,4 Watch6 4 Watch6 4 Watch6 4 Watch6,4 Watch6,4 Watché 4 Watch6 4 Watch6,4 Watché,4 watch6 4 Watché,4 Watch6 4 Watch6,4 Wateh6 4 Watch6,4