Francis Graf report - Amanda Ladas vs. Apple case

This is the 1d Affidavit ofFrancis Graf in this case andwas made on the 4Á day otOctober,2012.

Action No. 5112969Vancouver Registry

IN SUPREME COURT OF BRITISH COLUMBIA

Between:

Amanda Elizabeth Ladas

PlaintiffAnd:

Apple lnc.

"Brought under the Class Proceedings Ac],RSBC 1996, c. 50" ndant

AFFIDAV¡T

I, Francis Graf, Digital Forensics Examiner, c/o Suite 302-1224 Hamilton Street, in the

City of Vancouver, Province of British Columbia, MAKE OATH AND SAY THAT:

1. Attached hereto and marked as Exhibit "A" to this my affidavit is a true copy of

my expert report herein dated June 6, 2012.

2. The exhibit examined by me in the course of the preparation of my report that is

marked as Exhibit "4" to this my affidavit and described at page 4 of the said report as

"Exhibit 1 - #4C41081: iPhone 3GS Serial #799462PP3NP (MRitchie's iPhone)" was

hand delivered to me by Megan Ritchie on January 19,2012 at 08:30 a,m. at Victoria,

British Columbia.


marked as Exhibit "A" to this my affidavit and described at page 4 of the said repoñ as

2

"Exhibit 2 - #ACA1082: iPhone 3GS Serial #87024S1KEDG (iphone3gs)" was hand

delivered to me by Rahiman Sattar on January 14,2012 at 3:30 p.m. at Surrey, British

Columbia.


marked as Exhibit "4" to this my affidavit and described at page 4 of the said report as

"Exhibit 3 - #TCS: iPhone 4 Serial #881113G844T (Mommy's iPhone4) backup file"

was hand delivered to me by Norbert Pinter on January 14,2012 at 12:00 noon at

Vancouver, British Columbia.

SWORN BEFORE ME at the City of

for the Province of British Columbia

DAVID MI,JLRONEYBa¡¡istcr & Solicitot

MulroneY & ComPanYg}l'852 Fott Strect

Victoria BC V8\V lHt'"r: zso-sigó0 22 Fax 25&3E96033

GenLiU9ST2laff#1 of Francis Graf

Victoria, in the ProvincBritish Columbia, this day of

iOS4x Location Based ServicesAnalysis Report

Report Prepared for: Amanda Elizabeth Ladasc/o Suite #302-1224 Hamilton StreetVancouver, BC V6B 2S8

Report Prepared by: Francis Graf B.Sc., M.4., EnCE, CFCE, A+c/o Suite #302-t224 Hamilton StreetVancouver, BC V6B 2SB

Area of Expertise: Digital Forensics

Date: July 29,2072

iOS4x Location Based Sen¡ices Analysis Report

TABLE OF CONTENTS:

REASONS FOR OPINION AND DESCRIPTION OF RESEARCH AND ANAIYSIS.......................3

iOS4x Location Based Services Analysis Report

I nstructions Provided :

I have been instructed to provide my expert opinion on wha! if an¡ location baseddata is stored on devices sold in Canada by Apple Inc,, running the iOS4x operatingsystem and whether or not any of that data is transferred to any computerconnected to such devices when the devices are backed up in relation to Ladas vApple Inc. Vancouver Registry File Number 5LL2969.

Nature of Opinion Sought

I understand that my opinion is being sought to assist the Court in determiningwhether or not iOS4x functions in breach of users'privacy and security rights.

Opinion

iOS4x stores specific location based data in unencrypted form, including dates andtÍmes, assocÍated to geographic location coordinates, on devices that run on it. Thatdata is copied onto any computer the devices are connected to when they arebacked up. This location data spans a period of approximately one year prior to anygiven back up and is easily accessed using free tools readily available on theinternet.

Each backup file contains specific geographical location coordinates, including dateand tÍme stamps, in unencrypted form, for approximately one year prior to the date

the backup was taken. Each successive backup file contains new location data forapproximately one year prior to the date of that backup, thereby increasing theaggregate location based data stored in unencrypted form.

Reasons for Opinion and Description of Research and Analysis

The reasons for my opinion are based on the research and analysis performed byme as described in Appendix "4" regarding the location based data stored on AppleInc. devices that run iOS4x and the backup of this data to computers connected tothe devices when the devices are backed up. The process and methodology that Iused to preserve, recover and analyze the location based data stored on Apple Inc.

devices running on iOS4x, and their respective backup files, is included in Appendix"A".


Factual Assumptions:

I assumed that the exhibits ("Exhibits") examined by me:

Exhibit L - #4CA1081: iPhone 3GS Serial #799462PP3NP (MRitchie's iPhone)

Exhibit 2 - #4C41082: iPhone 3GS Serial #87024SLKEDG fiphone3gs)

Exhibit 3 - #TCS: iPhone 4 Serial #881113G844T (Mommy's iPhone4) backup file

and their associated backup files are a representative sample of devices sold inCanada by Apple Inc. that run on iOS4x and the associated backup files are arepresentative sample of backup files that relate to these devices and that, therefore,my findings are representative of findings expected on other Apple Inc. devices soldin Canada that run on the same i0S4x and their backup files.

Methodology:

Exhibit 1 (#4C41081) and Exhibit 2 [#4C41082) were examined using industrystandard methodology and tools described in Appendix "A". The backup file of thethird exhibit [#TCS) was previously obtained by another professional services firmand provided to me as a backup file. This backup file was examined using the samemethodology and tools as for Exhibit L and Exhibit 2.

Findings:

Each of the Exhibits exhibits analyzed produced a "consolidated.db" database filewhen backed up using iTunes software. This "consolidated.db" database filecontains an unencrypted twelve month cache of latitude and longitude geographicalcoordinates as well as date and timestamps of the respective coordinates.

This "consolidated.db" database file also contained the unique serial number of theiPhone being backed up.

4


Advice and Certification

I am aware that I have a duty, in giving an opinion to the court, to assist the courtand not be an advocate for any party. This report has been made in conformity withmy duty and I will, if called on to give oral or written testimony, give that testimonywith conformitywith that duty.

I am primarily responsible for the contents of this report.

Respectfully submitted,


Aprpenei ix A: í Phone Leieætie¡¡r Services Anar lysis tVletheielo!ogy

Create a "New User" account on the desktop PC in order to isolate thecreation of the iPhone backup to a unique location and avoid any risk ofcross-contamination of the backed up data across other users.

Place the iPhone in Airplane Mode and navigate to: Settings\General\Aboutto confirm the Software Version (4.2.I [8C1 8a)) of the iPhone:

1_.

6


3. Before connecting the iPhone to the desktop PC, open iTunes on the desktopPC. As this is the first time running iTunes, the user must "Agree" to theiTunes Software License Agreement in order to proceed:

iTunes Software License

ENGLIS}I

Apple lnc.Sofnvare Llccnse Agreement For lTunes

Please read thls software llcense agreement ("Llcense") carefully before uslng the Applesoftware. By uslng the Apple software, you are agreelng to be bound by the terms of thlsLlcense. ll you do not agree to the terms of thls Llcense, do not use the software. f you do notagree to the terms of the Llcense, you may return the Apple software to thê place where youobtalned h for a refund. lf the Apple software was accessed electronlcally, cllck "dlsagreeJdecllne". For Apple software lncluded wlth your purchase of hardware, you must return theentlre hardware/software package ln ordêr to obtaln a refund,

lmportant Note: To the extent that thls software may be used to reproduce materlals, lt lsllcensed to you only for reproducllon of non-copyrlghted materlals, materlals ln whlch youown the copyrlght, or materlals you are authorEed or legally permltted to reproduce. To theêxtent that thls softrvare may be used for remote accêss to muslc flles for llstenlng betweêncomputers, remotê accêss of copyrlghtêd muslc ls only provlded for lawful personal use oras othenvlse legally pêrmlttêd, lf you are uncertaln about your rlglrt to copy or pêrmlt accessto eny materlal you should contact your legal aüvlsor.

1. General. The soñrare, documentation and any fonls accompanylng this Licensê whether ondlsk, ln read only memory, on any other media or ln any other form (colledlvely the 'AppleSnfir¡rare") ârÊ llcênsêd nnl snlrl to vou hv Annlc lnc l"Annlê") for usê onlv unrier thc lerms nf lh¡s

', s"rra '' ' Decline '


4. After "Agreeing" to the iTunes Software License Agreement, iTunes will openwith a "Welcome to iTunes" screen:

¡Tunes TutorialsTutorial FeedbÂck )

i

- -Þ-

Welcome to iTunes.No!.r you can orqànrze arìd pl¿y your d¡q¡töl musjc ånd video on your l"tac or PC

^dd ¡t ro your

iPod or rPhone. ^nd

rn"o,n. "li:i.t;:;"" l::l""i

-t"*, ðnt't¡me Arr on iruner.

a

-

"rrffi g


5. [n iTunes, navigate to: iTunes\Preferences\Devices and check the box to"Prevent iPods, iPhones, and iPads from syncing automatically":

tf Prevent iPods, iPhones, and i s from syncing automatically

i nes is not paired with any Remotes Forget All Remotes


6. Click "OK" and the user is returned to the iTunes home screen:

e.\otfu\.-, '-i{

QwshffiÀ R¡dlo

ÍoRt

,'l\ Íun$ hr<hçQ Fñg

sHm€o

â Hom. 5bdñ9

GENIU5

¿ù €c¿¡u¡

UYLI5E!i: run.t Dl

$ m'r uu:ic

{ turrel Murt

+ hsr(uklÍ My T@ ur.d+ kccndy Add.rt

+ R(cntt tuFdë lop 25 hsr Phycd

MusicSjaJjí3 iìtd Ùlus r;',,ttlclr:: \,/(ì!r :ra:c t,) Ttrt|s .trJtlrr lr l.riL[: r¡ :orrrì itr:;l cjcrLrtr t' li r;k ii

Download muslc,a

lmport yout CDÊ.

(e

lvatch lne lùtd,a Cr)

Srcp lor musc ¡n the ,Tuæs Stde (.)

Find music files.

F d MP3 ald AAC lies I my Hole lo der O)

+,Ë c Et è 8.,,

7. Connect the subject iPhone and iTunes will ask if the user would like todownload the update and install it. "Cancel" this request.

A new lPhone software version (5.O.1) ls avallable for thelPhone "MRitchie's iPhone'. Would you llke to download itand update your lPhone now?

iTunes will verify the so re update with Apple.

l-l Do not ask me again

L0


8. Right click on the iPhone that is now displayed on the left pane and select"Back Up"

:a::rì;r.:tï

UEWY

.¡! msrfl uovtc:

Ç Tvshd

^ R¡d¡o

STORE

ü lTuñÉ sroE.a r!ñ6 Marh

çQ ñng

EW5

ctNtu5

{ entur

ruYLIS

Ejed'MR¡tchie's iPhone"

Sync "MR¡tchie'r ¡Phone'â Hm. sà frilsfer Pur<hõe5 from 'MRltchle's ¡Phone"

8¿ck LJp

Írme MRlt(hi.'s lPhonÞ

Capa<la!4 1,1.28 CB

Softwâre VêÉld: 1,2.1

s€rtal Numb.n 799.l62PPlNP

Phom Numben 1 (2S0) 686-4247

A nerer vers¡on of the iPhone toftì/aæ ls aveilable (wrslon 5.0.1ì. lo updeteyour iPhoñe wlth the latest roftw¡re, <l¡<k Update.

lfyou are experiencing problems wllh ydr iPhone, yDu c¡n rcslore ils o.¡ginalsttlngs by clkking Restoc.

fTunes

8¡ck¡ng up'MRit(hie'5 ¡Phone' e

Resel

I îuñé q$ n'r uu*â o¡iltc¡, Mutk

ü &r¡lc ud.otf nyrop uo0 ¡cntty ¡¿¿c¿

Ô R.andr Pl¡Fd

+ Tø 25 l¡o5r Plày.d

+TOE¡

The Back Up process begins:

eôetl +<{

lñfo AOpt Toncs lutl< k¡ct W 5hot5 tuo¡

Name: MRit(hie's iPhone

C.pÀclrÌi 14.28 CB

soñmre vefslon: 4.2.1

ser¡Àl Numben 799,162PP3NP

Phon. NumbeE 1 (250) 686-4247

SW€D

ô HmG shúgCENIUS

$ ccntur

MYUSË, ÍuÈr Dl

Ç 9o': rurt<

i¡ Clùstol tEk$ l*rrtcuduö ¡y rq utc¿0 ß.<Gilt Addcd

+ R!<.nrt ñ¡yrd

$ tø zs mr ileyca

,-, A nerer EE¡oñ of the iPfione software i¡ ¡v¡il¡bl. (w.s¡ü 5.0.11. To uldateI Upd¡te I wuriphonewiththelarestsoftwüe,dickUpdate,

,_, lf you are expe¡¡enc¡ng problems with Vour lPhone, you c¡n rc5tore ¡ts olìg¡nal| rutlore | *tt|rqr by cll<klng Re5torc,

> I MRlt.hlc'r ¡ñ ,Ff O

Gpàdry ,Il€8 G Audlo Ptu6 App¡ a otts Fe

E2GB 'o4JG ztB -ûxGE r¡@

TI


9. The iPhone displays "Sync in Progress", although no data is being transferredto the iPhone as the phone is only being "backed up" to the host computer:

Once the backup is complete, the iPhone can be disconnected.

L2


L0, If the iPhone Tracker software application has not previously been installed,it can be downloaded for free from:

F .\ rq petewarden/iPhoneTracker @ GltHub

FT;Icré m E coogla¡teps

This open-source application maps the informaúon that your iPhone is recor'dingabout your movements. It doesn't record anything itsel[ it only displays files t]at are

already hidden on your computer.

Download rhe aoolication

Read the FAO

tsA

V

L3


-

q___._"J \gz . - rI 7 g*Dr(ilonÀry OSLR Ca te Server DVD PlaÌer ttlesalvage Fllez¡llå font Eook

l"l or

L1. Once installed,launch the iPhone Tracker software application by clicking onthe iPhone Tracker icon in the Applications folder. This software applicationis programmed to read the suitable backup file stored at the default locationof the storage computer and display the coordinates contained in the"Consolidated.db" file as overlaid on a map of the world.

L4


LZ.The times of the location coordinates are plotted as the "timeline" bar ismoved from left to right at the bottom of the page:

I ¡Ul'fimcLf4 ffiøf O O*¡Stn¿tU+ ca/'i&d.æ, û-Dt-M

15


('ì

L3. Zooming in with iPhone Tracker softr /are provides increasing detailregarding the locations contained in the "Consolidated.db" file:

I

L6


For illustration purposes, in this example (MRitchie's iPhone), it is apparent thatthis iPhone was in Daytona Beach Florida and in Tofino, BC.

\

âFd \

krk j) \ÉM

-.'t" 2oll'05'I

Ua /c&,ø¿ O o¡tstiL tuL úitü' ;

20t l-l l-t6(ìr¡rltÈ.rll¡r

\

¡-? a

.. G--"Í

t\ r,r4/,,4,td,ooptw*op*r*t***

L7


Similar results were obtained for Exhibit ACA1082 and the TCS Backup file:

ACA1082 (iphone 3gs):

1.8


TCS Backup File (Mommy's iPhone4):

t ffituolBnbiñCol

r(

:Mðd9 tlidF

rur kry{T /è

t åñdey .\?

*r* \'.1.¡p1

r ,\['I'¡meæirø,æBr-el

L9


Appendix B: "Consolidated.db" Analysis:

Viewing the contents of the "Consolidated.db" file requires additional analysis usingspecialized iPhone forensic tools and scripts, such as those provided by fonathanZydiarski. The following steps describe the analysis process using Mr. Zydiarski'stools.

L. Firs! open a new terminal window from the Utilities folder:

Console Digitàlcolor Met€r D¡sk Ut¡lity Expose Cr¿b CrÀpher

-E- â",Tã Sälntell¡Poi lnstaller Java Preferences Keychà¡n Access Àl¡qr.ltion Ass¡slanl Ne(rvork Utility p .iàst Captt¡re

RAID Utrltty Renlote I t\.la( OS X Spà(es St stcm Prohler Ïernrinal Votceo\'er Utllity

^.( tù\\_,/

Xll Op€n rn t¡hder

20


2. In the terminal window, "cd" to the directory containing the Backup file:

ÊôÐ Terminal-bash-80x24Last login: Thu Jan 19 0B:46:42 on consoleFranci¡-Grafs-tlacBook-Pro-5:- aca1081$ cd lUsers/aca1081lLibrary/Application\ 5upp o rt /Mo b i I e 5 y n c./ Ba c ku p/ e 9 d b 6 3 c 6 3b2 43709 L c5a 5 6 9 f b e 1 a 6 5 t a44 7 c e3 3 5 I

3. Select "Enter", which will take you to that folder, and execute the"dump-mbdb-10.py'' Python script by typing "P5rthon" followed by a space

and then the full path to the storage location of the Python script [see belowscreenshot)

âr^ìe Terminal-bash-80x24Last ì.ogin: Thu Jan 19 08:46:42 on consoleFrancis-Grafs-llacBook-Pro-5:- acat081$ cd lUsert/aca1081/Library/Application\ 5uppo rt /Flob i teSync/B ac kup/e9db63c63b2431091c5a569fbe1.a651a447 ce335Francis-Grafs-l.lacBook-Pro-5:e9db63c63b2431091c5a569fbeXa65la447ce335 acal0Bt$ python /UserslacaLOBL/Desktop/i05\ Forensics/Fite\ Repository/Scripts/dump-mbdb-19.py H

2L


4. The Python scriptwill"filesystem"

parse the backup folder and create a new folder called

[f Eackup

fltEmlÐLl tÐ E qf:FlDtvtcts l¿rñrr ----

ffs377Ef4I9660a9...aad2Z 7Eed5 5 3 E7d

ffg94075cd364Ec8 .. lfEa362EZe0bd6e

ffaTe ld b3d647adf...679ff 1069956cb6 5

tfaf5 If¿9bd 9470c4...6b6(30ee7 2a4 5 E4

ffb8tbf6E77e4 122...77 E76724oc3ad09

ffce45 rcla60d3cE...å946ddf4b3ÀE275cffcea4f4 7d3Àdf93d...0c96a2e ZfalaEb 29

ffcedlf704cf65d66. 3E74946985 5 1643

Íld3c7 L4c7.dagl7. .e 500EBb5b3c Ie40

ffcldd966fzb7E4 I ¿.. .4b3c9789E Ifcb36c

ffe6ddb2ac75ba5b ..9aåfdfSb600lbce4

DarÊ Mod¡fiÊd

20IZ-01-19 9:03 AM

Z0lZ-01-19 9:03 AM

20I2-01-19 9:03 AM

20IZ-0I-19 9:01 AM

2012-0I-19 9:04 AM

20t2-01-19 9:01 AM

20lZ-01-19 9:03 ^M20t2-01-19 9:03 AM

z0l2-01-19 9:03 AM

20I?-01-19 9:03 AM

20IZ-01-19 9:01 AM

-a

5I IARTD

PLAC IS

Fl Desktop

fi acalOEl

; \ APPtications

'Docum€nt5

5IARCII FOR

: ' Today

: Yesterday

, Past week

þ Àl tmages

l_l ltt r.lovies

þ All oocumcnts

lnfo,pl¡st

Manifest. mbdb

Man¡fesr. mbdx

Mànifest.plist

Status. pl ist

t.2

l.l

96:

73;

l.z

20I¿-0¿-Il Il:42 AM

Z012-02-Il ll:42 AM

2012-02-lt ll:42 AM

2012-02-ll llr42 AM

2012-02-ll ll:42 AM

z(

42ì9

L of 2,774 sÊlected, 53.88 GB ava¡l¿blè ,,

5. In the "filesystem" folder, navigate to the

\RootDomain\Library\Caches\locationid\consolidated'db file'

f:Tr[J BackuptÐE

^ DnteDt\/rcts

SIIARID

PLACISpl ocsttop

Q acalo8l.\ Applications- Docurn€nÎt

5IARCII FOR

,¡ Today

: Yesterday

,. Partlve€k

[J ett lm¡ges

þ Atl Movies

þ Att oocuments

.__..j AppDomaln-uk,co.bbc.nervs

i__l HomeDomà¡n

; -r Keycha¡nDomain

*' ManagedPreferencesOomain

LJ MediaDomaln

.--r MobileDeviceDoma¡n

r.J RootDomain

¡r Library

rél Càches

tê¡ locÀtloncf

cl ients. pl ist

20IZ-01-I9 9:13 Alì

20lZ-0I-19 9: l3 Aò

2012-01-19 9:13 AIZ0I2-01-19 9: ll AÀ

2012-0I-I9 9:13 Ai¿012-0I-I9 9:13 Af\

20lZ-01-I9 9:15 Afi

20lZ-01-19 9:15 Añ

20IZ-01-19 9: I5 Afi

20IZ-01-19 9:ll AÀ

20I2-01-19 9:04 Ai

sig nifi cant.pli st

l--r SystemPreterencesDomi¡n

- WirelessDome¡n

lnfo.pl ist

Manifest,mbdb

2012-01-19 9:03 Ah I

I

2012-01-19 9:13 A[ I

20l2-01-19 9:13

Z0I2-02-lI 1l:4201.2-02-ll1l:4

22


6. Right click on the "consolidated.db" file and select "Open With" the free utility"SQLite Database Browser" and view the contents of the database file:

I SQLite Database Browser 2,0 bl (default)

vlMove to Trash

Cet lnfoCom press "consolidated.db"Burn "consolidated.db" to Disc.,,DuplicateMake AliasQu ick Look "consol idated.db"

Copy "con sol i dated.db"

Show View Options

Label:x

ffi atl l'nugus

þ Atl Movies

þ Äl Documents II

7. Click on the "Browse Data" tab to view the contents of the "WiFilocation"table:

' å ^ ^ g SqJÞ tÞÞbóe 8|!æ, - /t ss5,,e!,Otf/Ubñry/Appllorion SuppodJlrobil

DÉHç É'#drrÉ E N?

T¿ble: ^MC TlñéhÞ

r 0:21:2t:¡5:eb:ai549a{,9,113262 O:15:7O:P7:d1:.;54941941326J 1e:8|3¡192:(l:;59736,838681a 2:11:11:97:db:(i59716.818684s 0r18rd1:79:lf:d;59716.8386846 0:f:3d:5d:fc:7ait9736,8186847 Ot76:I:84:b8:7t;59736818684E 0i26:B:1bi€:61;597368186819 0:1er58:e8:(b:3;59716818681ro 0122:2d:de:b2:ii39736 818684r! 0:11:24:æ:5¡:l;59736.83868412 0:22:6b:3f:82:c i59736 838684ll 0:d:88r28:57:91i59716818684ra 0:22:2d:dêrde:6;59t36.838684r5 0ì14:d1:40i11:;;5971681868416 0rf;ldrldi95:b6;59736838691

r@dc bdMe18.42ar8942 -r23.¡681S935

48,42633491 -121 f65773218 4240151 -123 35915401

18 12607 969. L2) 357660tt48.42619276. 123.35462015

4 8.4!69507 - t23.37 62t16918 41964296 -123 161919818 41103724 .L21 3152792748 41s6670t -121 34748É7

48_42!65584 -123 311r890948 41941151.123 3l815l9l,r8 42721146 -123 336468041A 4291909r -121 4005226418.419 4130 4 . t23.380494 4 I48 42739486 .121 406920f71A41A25726 -123 142853

7&O

810t1086077096.0990s0086.0760500980s2.078056.0960

0.o000000000.00,000000.0

000,00,0000,00,0

-1.0-10-1,0-10

-1.0-10-10

-t u

-1,0-1 0

-1 0

-10-1,0-r.0

Vd.JA.curÐ 5æd

-1.0-1,0-t 0

-1,0-10-1,0-1 0

-1.0-10-10-10-10-10-1,0-10-1 0

- t{sReaord

Cotr3. CffiÐ(è-1.0-10-10-1,0-10-1.0-10-10-10-10-10-1,0-10-1 0

-10-10

- !:!!3!:!9d-

soo50

50

50

50

50

50

50

50

s0

50

so

I - 1000 of 128170 c.r' o

23


...or the Celllocation table:

A ^ ^ € SQUæ D¡t¿bóe 8.Mer - /ui€rr/¡c1081/Ubr¡ry/Aopl¡at¡o¡ Suppon/l,lobll€Syìc/B¡dup/egdb63<63b24

DÉLJ"¡ g#dtrJT E N?Detåbåse Std<lue Êx€.ute SQL

Tebl€: C€¡lLo(at¡on ._::__ ' N* R"."rd ' D"ld" R"@d '

Mcc uK uc ct ftñffip bùù& bgiù& Hd¿mdA..u A(þdG vÉdcdAfturÐ 5p.d fîr ro2 Eao 11101 72169t8r ts7r69.82ta39 49.2609548r -¡23.¡2197q1 5(þ.0 0.0 -1.0 -t.'2 102 880 11101 72167119197t69.828139 4928113746-t2rt22l6r62 1089.0 00 -10 -1j 302 880 11101 22168140t57169828419 4928t10787-121L22751L3 500,0 00 -10 -11 302 880 lll0l 72t7262tt57t69.828439 4928015517-121t2296807 6970 00 -10 -1t 302 880 11101 72t73727t57769828439 49,28120446 -123 1205843 5000 00 -10 -16 302 880 11101 72!68781t57L69.828139 49.2Ì994t6t -L2J.L219238 500,0 0.0 -1.0 -l7 302 8l¡0 11101 t21?Ot27157169828139 4927977275 -L21,12L16ú 5000 00 -10 -18 102 880 11101 72t71783t57l69828139 492798t299-r21.12s20074 5000 00 -10 -le 302 880 11101 72166624tt7169828439 4928318126-121 12161827 5000 00 -10 -1r0 302 S80 11101 72165?02t57169828439 49.28t54t32-121,12215331 5000 00 -10 -1LL 102 880 11101 72172782t57t69828439 4928368525.123 12230914 5000 00 -r0 -1tz )02 880 11101 72167783 157169 828419 49 28125214 -123 12616613 500,0 0 0 -1 0 -1r3 302 880 11101 72166782 rs7169 828439 49 28185251 -123 12157061 S00 0 0 0 -1 0 -1L1 302 880 11101 72168621t5?L69 828419 4928066486-121.11122874 500 0 0 0 -1 0 -115 302 880 11101 72t727o2t57169828439 19,2829O802-L2112599811 5000 00 -10 -1.

0 -10 .-l'1 - 1000 of 6281 Coto 0

Note that the location data has been cached for 12 months prior to the date of thebackup. Each successive backup creates a new cache of location data for the LZ

months immediately prior to the date of the new backup.

Note also that the unique serial number of the iPhone is also contained in theConsolidated.db file

A^A El ACAIoSIJPC

7ñtÃ hË

SQLrre Darabage growser - /Users,/lest/Lrb/arylAppli<atron Suppo(/['l

DÉ-1 .¡ s#dri t E N?

Databæe Stru(tuæ 8¡wie Dðtà Execute sQL

Nry Record

Sofwnlvsdoh *¡ðlhmb.r

370.3 799462PPlNP

r70.3 799462PPlNP

370 I 799462PPlNP

170 3 799462PPlNP

370.1 799462PP3NP

370,1 799462PP3NP

170,1 799462PP3NP

170.3 799462?P1NP

170.1 799462PP3NP

170.3 799462PPlNP

170 3 799462PP3NP

370.1 799462pP3NP

170.3 799462PP3NP

Table: Tablelnfo oÞlEte Rèaóad

1

z

l4

5

6

7

I9

l0IIt2

t3

TüùmêFen(6comp¡ssCalibrarion

WiñLocal¡on

CellLocationLocal

CellLoc¡lionLocalEoxes

CellLo(àt¡on

CellLocat¡onBoxe5

Location

wificell

CellLocationHñe5tW¡fiLocationll¡ryest

LocÀt¡onHarye5t

24


L Further analysis of the location data stored in the "consolidated.db" fileutilizing the free Google Earth Fusion Mapper

provides more detailed mapping results than the iPhone Tracker software.

For Example: Analyzing the ACA1081 exhibit backup file and its associated"consolidated.db" WiFi Location table provides the following detail:

C:\Users\Francis GrañDesktop\WiFiLocationOnlyWithDatesandTimes.csv Fráßjs Grãr

Fle Vffi Eü VissÞe Mãge EFhFt

ShùE .¡ ¡Ûn 9dþS

LoGtion Lthrde E Db¡ay as hearmap cm6Eq€ hfo *ldq cqfure sNles Eed lo ilL

fitq; fs"þnê l

ill

ïli

TIa

"lD

lrl

4' t¡l

a

rÐbl-tr- ."- uan. r,,l.l,- s,2c€ k.ÈFrr<+.@

Zooming in and selecting any one of the data points reveals the date and time of thatpoint's collection, providing very specific location details.

a F. 'rrÈ rÈ-r

ClUsers\Francis Graf,Desktop\WiFiLocationOnlyWithDatesandTimes.csv Fræis cr¡'

Fil€ VH Ed MluåIze Mergê Eìçerimúl

Stuwitg âr fæ gdi4

Lodbn tÂùtudêE ObCat æ h€d m¡p Cntu€ hfo údw Cdlìoure sNbs E¡M lo KltL

o€a

oo

oo c

e

ee

,eo. 99 o

A more detailed description of the Google Earth Fusion Mapper Methodologyfollows:

25


Appendix C: Google Earth Fusion Mapper Methodology:

1. This process requires the location data contained in the "Consolidated.db"file to be exported to a ".CSV" file format using the same SQLLite DatabaseBrowser software.

':¡.'i,È,il

26


2. Choose the appropriate table from the "Consolidated.db" file to export (inthis case we have chosen the "Celllocation" table to export).

ÉÉ a

DÉH"¡td'#dEitr EIN?ù6* sb*ht i Eræ DðÞ -a."ru sql

r*' lc.r-u' -l@ ttÈ"î*d llo.tcn*¿-l- --l'lcc

Hñc 1 c c¡ rnñ6t¡mp Lðtrü¡de lomt¡e tlor¿oui¡sr A|tt¡de - ;iIt I o 0 o oiz3az7fi,4lolrtt o.o 0.0 -r'o oo

i

¿ $z 7m .t+r5188 t826.0 0.0

I 3 nz 7Ð .l{ltm$ 869.0 o.o i

4 12 7n I 8.1{73316 956,0 o.o

s 302 iæ ll tææ: icæú :l lE.r423sl5e ff,ó,o 0.0

6 1J2 7n I I -t13,És52¿65

68¡,0 0.0

7 nz izJ 1l ñr¡o¡sæz 8{5.0 o.o

8 $2 7n I I 5 13,13886{21 8lZ0 0.0

9 rz tû I I ßræ++srl soo.o o.o

10 rz 7â I I I ¡+ I I ræ I ll^fiel{ts ls5l.0 0.0

11 llz 7m 306{ 5000.0 0 0

8lz0500.0

1551.0

s000.07m

7â7m

7n7t)72î

iu n2. ?â 3. 5ooo.o o.o I13 Ð2 7m 3. 5(ÐÛ.0 0.0 I

1{ t 2 7m l. 5{n0'0 0.0I

15 .I)2 7Ð l. 5m0,0 0,0 I

' r 6s1o m411 r23æ27s.{ffi4s €.1696611 -, o.o Il ta })2 7zo 6fr10 6¡)411 123æ2750.J50645 €.1696611 -rzl.t{663l6{ 5om,0

lt nz 72Ð õflro s7¡7+ 3232927Ð,45M+5 Ð.1618719 -rzl.13€oæl 50û0,0 o.o -il1

6fr 10

5q)O.0

5(Ðû.0

5{n0,0

cno,0

50m,0

3.

l.0.0

I

0.0

0,0 |

o.o I

1 - 996 of 996 l¡"u I o

27


3. Choose an appropriate file name and storage destination for the exported fileand select "save":

I Save Às

Sesrc.h Cirr Computer ) SANDISIG2 (F:) > CSV Files

Organize - New folde¡

- SANDISKI2 (Ft

,Spotlight-V100

,Temporaryftems

.Trasher

ACA1081

ACA1082

A(41083

Analy:i:Files

Apple

CSV Files

,: . ACAlOSlWiFiLocationCSV

.,,-ACAl0S2WiFiLocationC5V

$ acmoarwiFiLocationcsvt$ acaroazwiFiLocationc5V

$ lCnf æzwiFiLocationExport

1$ua"*+ac-atcw

il!- Õ

Date nradified Ti'p.

3,-t,,:t¡:¡,i1¡ :r:i5 Fl.1 filicrc

.lrì, 'iì 1t112 :l:l; Pf 'l l.lìcrc

j,_r ,-'ì_l :,.¡1:9rl-5 Fl.l l'li':r'r

.1,-1, r-¡l'l[11] ir:.'; P¡,1 l',1irrc

16.,1:l lt-¡l1 l1:11 ,,. l,licrc

Filename: Lada{4AC-dfCSV

Ted files (*.cw 'bd)

28


4. Once the export has completed, select "OK" and close SQLite.

9 SQI¡'!e D¿t¿bæ 8ær - F/ÍCS B¡e¡p:/Bælo¡plt¿d¿lB¿dud04x5cb7û22b67f,3<87dtút.7:18b55o51d596d/fil6¡/st mfiætDaæin/Ubrary/Cadti* I

DÉH.¿lffi#dÉillEih?Dðbböe Sbwb¡e ì *øæ O¿t , e*rt SCf i

r*, [c"r-u-------------l @HCC

0

7Ð7â 8Ìt0;

650 10',

650 10

6$ 10

6$r0

n2 7Z)

n2 7m

Ð2 7n12 7n92 7æ SrfX)

I N* R*d I tod.E R*d

Îm€rtam9 Latilude Lonqil¡rde HorizontalAE¡r Atit¡deo 32t292m,4lo{¡9 0.0, 0.0: -l.o

qsrl4:¡z¡æzz5o.r5o6¡s .19.16{z+rl -rz¡.rclos]ssi 1626,0

{t.16{9{X¡5 -125.r4r100}l

Èí{c

0

Ð2

T216{07{18 -121.t4r73116

163t8589: -123.142351595

lei7I

is

]ro11

12

t3

1{

r)2ï2

7æ 65010

Tâ 8æO

líyJ,7zt -123.1.1635282

1ffi58 -12r.13886421

16558t+ -123.118+1513

161010561 -r21,14481419

l€255 l23æ27$.'t50645,q82tl 123æ27$.450645

û1161321æ27yl,+ffi45

r5 rz 7æ 6f110 6{x15 323æ¿750.{f}6Js

16 1? 7â,. 65{ì10l @,114 32J2927s0.450645

L7 12 7n 6iQi0 - _ 57\11:21L21p.45{fót_ {9.tlt n

12 7m 65010

Ttz 7m 6$¡0í2 7â 65010

3OZ 7n, 6$10

1696óll -t¿1.146ó306+

1696611 -123.1.t66î6¿+

l -121.1{6636{

1 -123.1166Íú{

I -123.14663061

. 1-996of996 l c"o. Io

29


5. Open the newly exported file with MS Excel and save a copy of it as an "ExcelWorkbook", which will enable the ability to add formulas to the table.

\I Newt-

5.u€ ¡ (oÐ olülcdo(l¡mút

Etrccl YYorlôookSavc thc f¡|. !s ôn Excel Woftbook.

ñl t_jll bàsed

r;ì:!!d b¡n¡ry f¡lc f ormat

ng and saving,

hat ¡r fully

OpenDo(Um€nt Sprcadihccts¿ve thê wortbook ln thr Open Do(umÊntFormðt.

!-l Qtñcr FormãttItd open tne sav€ A5 dialog box to r€l€ct from

ðll posJ¡ble filÊ typ€r.

jo¡nt.tt -jà orl.t. -'Ë romat -

Ctlls

:G'ng¡tude Hor¡zonta Altitude

-1

7826

869

956

896

684

E45

817

500

1553

5000

5000

5f)00

@-o

ffdtSoÊ& F¡nd 6(Filt.r- 5êlÊct-

Editlng

xl-2-

llil))l

Save

sôvr A5

Prlparê )

rublith )

Closr

123.143

L2?.r42

123.142

L23.t46

t23.t46123.139

123.138

123.1r5

123.147

t2?.747

t23.!47

J

VerticalA(-1

-1

-1-1

-1

-1

-1

-1

-1

-1

-1

-1

-1

0

0

0

0

0

0

0

0

0

0

0

0

0

) Computer r SANDISilG2(Fù r C5/Files Secrh (!t' . P

Organire ' fi Op.n

r -

SANDISK32 (F:)

,Spotlight-W00

,Temporarfterns

.Trashes

ACA1081

ACpJ-o82

ACÄ1081

AnaþsirFiles

Apple

CSV Files

Ladas04AC-dfCSV

l,ticrr¡scft 0ffirr E¡cel Co¡nr¿ Separated \'¿lues Frle

D¡te nrcdif ied: 8 /07 / 20t2 6:29 9M

Si¿e: 114 KB

D¿tË Ér€atedi Ðí07t20l26t]9 PM

X EIit ac.l

30


6. With the file open in Microsoft Excel, delete all of the unnecessary columns:

â-Jà

Pð-rtc t

Clipboôrd r,

sMNC

720

720

720

tadåd)4Ac-drcSV

302 720 65010

302 720 8200

302 720 65010

302 720 8200

302 720 65010

302 720 65010

302 720 45010

e Inscrt Pagc Lôyout Formulaj

Calibri ' 1l - ,= = g, lrD.r u-rAdi 1===lE-

AlignmÉnt

Horizonte lAccurecy

Dãta

General

,$ - o/o

+.0 .00.00 Ð.0 '

Number

DEFT¡mestam Lat¡tude

0 3.23E+08 0

909t44 3.23E+O8 49.LúT7¿18258 3.23E+08 49.16494

913198 3.23E{8 49Jffi47913824 3.23E1{8 49.16319

913225 3.23E+48 49.t6547

9L3228 3.238r{8 49.16302

57779 3.238+fi8 49.16409

913195 3.23E+08 49.16558

ß252 3.2381{8 49.16101

¿18256 3.23E+08 49.16966

¿t8æ5 3.23E+{8 49.16966

Æ254 3.23E+48 49.16966

' d"'t

sY.t

rl

jo Int.tt 'jì. Dclcte .

ijl rorm¡t'Calibr¡ -11'Ai$-olo

B r = ;:,¡:.i, ib. Â _ -.¿g l

Ar. Mcc2

3

4

5

6

7

9

t011

t213

14

Ìaat)l

0

302

302

302

302

302

t-ongitudelHor¡! ó cu!

o | -.å copv

-123.143 | -:{ pur*.I-L23.L43 | parte Sp.ciàt,.,I-L23.t42 | msert

-L23.142 i o.,.,.-\23.!46 I! Cleðr Contentt-123.146 I

-L23.t?g if Eornratcells"'

-123.138 i column width"'

-123.145 I H¡deI

-t29.L47 j unnio.

-L23.r47 5fi10 0

-t23.t47 50fi) 0

Ready Avcràgr: f8.149,5^{137 Count 9|l?0 Suffi ¿lE25t¡132

31


7. Insert three blank columns between the "Timestamp" and "Latitude"columns in order to create room for the calculations necessary to convert theMAC "Timestamp" to Pacific Standard Time [PST):

49.tæ77 -t23.t4349.1f494 -t23.L43

49.tW)7 -L23.L42

49.16319 -L23.L42.

49.L6547 -L23.L46

49.16302 -123.146

49.1ffi9 -L23.L39

49.16558 -L23.738

49.16101 -t23.t4549.t6966 -723.147

49.16966 -t23.L47

49.16966 -723.L47

32


8. Enter the following formula in cell B2: =A2+9783O720O to convert the MAC

timestamp to UNIX Time:

Homc ' Inrart hgr tryout Fomulas Datô Rcvl?vì, Vlcrì, Add-lns

General â, io In¡ert 'l$ - Y" tl ocletG-r+.0.0ói stylcsr .ôo -.o I - Fotmrt -

Numbrr rv Cells

@- a

frnSort & F¡nd &F¡ltcf' Scl.d-Editing

x

h Calibri . lt ' i= -- =, ã

Clipboard r' Font r' Alignment r'

E¿

l-l =A2+9783O7200 \82 v

A

1 Timestamp

2 323292750

3 323292750

4 323292t50

5 323292750

6 32'3292750

7 323292750

I 323292750

9 323292750

10 3232927s0

11 323292750

t2 323292750

13 3232927sO

t4 323292750

BCUnix Time GMT PST (

E

Lat¡tude

F

Longitude

0

-rz3.t4?-123.t43

-123.142

0

tæ77tffi94

ll .l ) xr LadasO4AC{fGSV :.J

49.16319 -123.t42

49.16547 -r23.L46

49.16302 -123.146

49.r64f)9 -123.139

49.16558 -123.t38

49.16101 -123.1¿15

49.16966 -L23.L47

49.16966 -123.t47

49.16966 -123.L47

Rc¡t ffiEE

33

iOS4x Location Based Seruices Analysis Report

9. Enter the following formula in cell C2: =B.2/(6O*6O*24)+"L/L/L97O" toconvert UNIX Time to GMT:

Homc : In:crt hgc l-ryout Fonnula¡ tlata Rcviov Virw Add-In¡ 'O - a X

=EZ / 160* 60' 241 +" L I L I L97 0"

ABI T¡mefamp Un¡xT¡me

2 32329?750 1301599950

3 323292750

4 323292750

5 323292750

6 323292750

7 323292750

8 323292150

9 323292750

10 323292750

11 323292750

12 323292750

13 32329275A

14 323292t50

49.f.ú07 -1114249.16319 -123.r4249.t6v7 -L23.L46

49.16302 -L23.t46

49.16409 -123.t39

49.165s8 -123.138

49.16101 -123.1¿t5

49.16966 -L23.L47

49.16966 -L23.L47

49.16966 -t23.L47

l{ l t }l Ladad}4AC-dfCSV

34


1-0. Enter the following formula inPacific Standard Time (PSTI

CellD2 =C2-TIME(8,0,0) to convert GMT to

ðètr' t

Clipboard r.

Catibri '11 -,===,=tE r rr -il¡- ¡'t i= = =lg-i:::i::: -iIô- å¡,i I;FiFllpz-|

Font r, AJignment r,

1 T¡mefamp Un¡xT¡me GMT

2 323292750 1301599950

3 323292750

4 323292750

5 323292750

6 323292750

7 323292750

B 323292750

9 323292758

10 323292750

11 323292750

t2 323292750

13 323292750

14 323292750

-123.143

-L23.143

-L23.L4?

49.16319 -L23.142

49.1.6547 -L23.r46

49.16302 -123.146

49.1æ09 -12?.139

49.16558 -123.138

49.16101 -123.1¿15

49.16966 -L?3.t47

49.16966 -L23.L47

49.16966 -123.747

35


1l-. Once the formulas have been entered in Columns B, C, and D in Row 2, thenhighlight the three of them across that row and drag to the bottom of thesheet to copy the formulas into each of the cells.

)rtr'r-Home lnrcrt hgc Layout Fomulät Rdi.w Virw Add-¡n5

- à, j-lnscrt - t -

rJ Drlrte- O-Stvlët-- Formåt - ¿-

r, Cells

@

if-7Z)'I

-r1 .](

dó

àPaJtr-t

Clipboard r,

Calibr¡

iB r u -rt.f r'l::::.:: .11(rì)- Â.r

Font

l===3 GÈneral

i===ld- l$-%ËF 5*= lfz- r -'et ;?8

Alignment r, Number

sort & F¡nd &Filtcr S€lcct-

Editing

B2 l- I =A2+9783O72OO

GMT PST (GMT-

EFLatitude Longitude

0049.Læ77 -L23.L43

49.r@94 -t23.143

49.t&O7 -L23.t42

49.16319 -L23.L42

49.16302 -123.146

49.16409 -123.L39

49.16558 -L23.t38

49.16101 -123.145

49.L6966 -L23.L47

49.16966 -L23.147

49.16966 -r23.t47

40633.81424 srl 03 | zorL Ll4o6zz.gL4z4 ïLl os I zorT tt4o633.9L424 3! 03 / zotL L

4a633.8L424 ztl oJ I zoLL tt4o633.s1424 zLlo3l?ott r¿10633.81424 31/03/2011 1ræ63?.814?.4 tLl 03 I 2017 tt4o6gg.gt4z4 t1 / oz I zoLt tt40633.81424 svo3lzou u

'i,2 323?927501 1301599950

13 3232927501 1301599950 û6gs.aL4z4 3 il03l2011 1r

1..)'l tadasæAC-dfCSVRcãdy Avrrage tl!11078568.2 Count 2988 Sum:

36


L2. Save this new file as a "CSV" file in a known location as it will be required forthe Google Earth Fusion Mapper:

Disregard the MS Excel warning regarding losing incompatible features as a CSV fileis all that is required for the subsequent analysis. Select "Yes".

[fi s"*at

I Computer ) SANDISIG2 (FÐ r CSì/ Files

- SANDIS|G2 (Fù

,5potlight-Vl00

,TemporaryItems

.Trashes

ACA1081

.4C41082

ACAlæ3

AnalysisFiles

Apple

CSV Files

l.lame

, "1,-ACÂ;L0SlWiFiLocationC5V

' tl,-ACAl0S2WiFiLocationCSV

S] ncarosrwiFiLocationcsv

$ ncnfoazwiFiLoc¡tionC5V

$ nCnfOtzWFiLocationExport

$ haaø+ac-drcsv

$l LadasCellLocatior{XAC-dfC5V

Date nrodified T¡rpe

ìiti,i3.'¿¡t ' 9r25 Fl'{ lili,:rcji-J,r-11''2û11 9r27 Þ1"1 lilicrc

lú'r_tj,'.ltLl.i rlr25 Pl,l l,lirrc

lfti¡]l-)nl' :l:.17 PIil t

16 -tl' 2011 11:11 ,,, li

l'l,,li j2ir12 ô:19 Plrl Llicrc

29¡r,-17¡.1ú12 6;-qr5 Pl¡l l,,lrcrc

Tags: Add a tag

CSV (Comma delimited)

l¿dasceflLoøliffio,lAcde9v.clv may contúì ft¿tJ|es t]Et are not corpatible with CSV (Cørure delimiÈd). Do yú ,,{ant b keep ün wod<bod< ¡n

üús fE mât?

.To keep this furm¿t, wHdl leaves out any hmpatùh ftaüres, c¡4 Yes,

. To feserve he feaùres, dd( No. Thð sve a mpy hr tfe btest Ercd fumat.r To see nirat n*¡ht b€ lo€t, ddc H+.

37


13. Open Google Documents and select "Create Table (beta]:

¡ ÞFræ- t1 r-mÉ- ùìEd.. @¡q'-. Ðptt...

Docs

E Doæmenl

El Presentalion

I s¡eadstreet

Ð ro-' Dwing

- ! t"u" 1u"u¡

, ê Scri¡

ì co¡lection

From temdate

fako our s!my! son - O

oYfllER tasT '.loolFlio

38


1-4. Browse to the location of the "CSV" file created in step 12

¿sour(é?dsrc¡d P- gB¿X

+ Þ Fre.. ir Îme,. á-lE¡¡t-, @ Sary... g-l ltus,.. ô - q¡r v Pðge v Toole '

lmport new tabl€

. l, From thLs ømu¡ts'f

l$ Google sPreacst e"t"

Sepilalordraracler o Comma Tab Colm Other

Charadqenødng UTF4 E

Ydcaf, ldædsprcdihe¿h d€hmddt.dIes(crv l.r or td]¡nd Kethoþ Matup Lrnquàge ÍÞs I hl) lerc

Or search puu¡c data labþs

Nêwto Fu3¡on Tables?Take a peek! !þy¡4[þ3-¡þþ59! or bv å lulorial

39


L5. Accept the defaults and select "Next":

+ ÞFre.. ir 1mè.. ÐEas.,. @eaqy... èlntur... ô - qp . Prge- Tooþ-

lmporl n€w table

iJ F,mrhtscomnuter

] Fl coogt" sp"".drh".L,

Create empty lsble

FICSVF¡ks\LadæCe&-rl glm I

Separatordraracler . Comna Tab Colon Olher

ChaEdererudïE UTFj E

Y@ c¡n upio¡d spredsÊelr dehnd bxi f æ ( Bv tsv or tl)ùd Xeyhole Mfrp ta¡guåge lre ( rml) !ro

Or *ardl puHh dala tables

NGìfl to Fusion Teblcs?Take a pe€tl PlBv with a dala set ø lry I tultrial

+0


L6. Google will now "Load" the CSV file:

tD¡t¡Sourcc?d¡rcid, P - 3 E d X

.¡ Þre.. i( 1ìmè,. -Et!t.., @taq¡... a]ltur.. ô - q¡' - P!g. v 'fool! v

rJ Frmtrirønputer

] øfl coosø spreadsheets

Create emply laHe

F1CSV F¡ls{-adæCe[-t[ glm ì

Separalorcharärler 9 Comma Tab Colon Olher

Charôcts€n@ùE UTF4 E

Y@ c¿n uplnd rpre¿drhe.lr dd,mdd ld its3 ( ctv b/ d H)¡M Keyhob Lletup L¡nguåqe fl€ ( knt) Lê¡m llæ

Or search publh data lablæ

Hcw to Fuslon Tablæ?Tsk€ s peek! Phv with I d¡la sel ø ky s lutsial

41.


17. Enter any map metadata that may be appropriate (not requiredJ and select"Finish":

/fusroñtðbls¡Dôt.SourccÌd¡rc¡d .9 - ¡ e O X

ir ÞFe,,. r' Tih¿.. AE¡!L.. l[tary... Ðntur... ñì ' q, - F.9ê' Tooli -

lmport neu, table

loble n¡rc F;\CSV Fi$\LBdasceilLoæliono4Ac-drCSV æv

Allor export / ?

Attribute datr to

Attribution pago llnk

Dercflptlon Iq)orted aÈ sutr,IuI 29 19!06:3g pDî 2oLz f¡oE E:\csvFiles\lEdasCef llocaÈÍon0lAC-df CSv. csv.

For ex3cpl¿ vrhal Kou6 Tou l*è lc reronrg sboul S¡s liòlc rn ¿ )err?

Ncw to Fusion Tablcs?Take a peek! Plav with a daÌa set or.Bj-!u!gdel

42


18. Select "Visualize - Map" in order to display the records in Google Map view:

m.googlccom lu::ciirbi€: C¿t¡Scurcelcccrd=Þ. A 3 O X"l

rt\cwrtr\ua*cdtlc.t . x

r ÞF¡e,.. i: Time,. ¡--Eóst... @tasy... è-ctur,., _ì.fEJ-P,ge-Tool5-

F:\CSV Files\LadasCellLocationO4AC-dfCSV.csv

File Mew Edl VFualÞe Merge Experinflt

32329274 599950Tlmeline3232927t 1599950

GtfT .

40633 8142,t

40633 81424

40633 8r42,1

40633 81,r24

40633.8r42.1

40633 8 t424

40533 81{2¡l

40633_8142,t

40633 81424

40633 81.t24

40633 81424

40633 8142,t

40633 81424

1û633 B1424

40633 It424

40633 8r424

40633 81424

PSr (GilTil -31i03¡20't1 1 t 32

311t312011 1'l:32

31103t201 1 l1 32

31m3r2011 11 32

3l/032011 11:32

31/f13.2011 11:32

3'l/032011 11:32

3l/03/20'11 11:32

31n3t2411 1'l 72

3ilßr2[f1 Í3231m32011 11:32

3l/I]32011 f l:32

31/03¿0111'l:32

31n3n011 11:32

3103i2011 11:32

31n3n011 11:32

31n42011 11:32

Latltude -0

4S 16411411

49't6494005

49 16,t07418

49 163'18589

49 165¡1672

49 16301721

49 1640858

49 1655814

49 1610 1056

49 '16966'11

49 16966't1

49 1696611

49 169661 1

49 169661'l

49 169661 1

49 163797t9

43


19. Use Google Map functions to move around the map, zoom in, etc.

È 1Þrrc- rcTmÈ. €lErsù-!¡"ry- ÐP¡+,

F:\CSV Files\LadasOellLocation04AOd0SV.csvFle VH Edt VlsuslÞe l,lsge Erçerhnsnt

Shorvhg ¡[ ros pl¡rc

t-ocaøn LarttuOãfl E]Dàdeyæhoanep Corturehfouhdore CqúqmsMæ DtrlffdlfiL Dwnlo¡dKlñ-li* @erùodddohl¡


Fë.; r

FICSV Files\LadasCælllocation04ACdËSV.csvFle Vw Eü ì/kuaÞe Mqgs E)q€{ùDal

Sh6,t{ dl rEs! odim

s*¡büri.t St¡l .ù-f

Lmdm reünrrie[l Eobflayæhearnap Cn0$Ìåhtuutuør Cqúmeùha f]qmlo¡dXlll Omlo¡dKlfl-hk

\-,tH0g

E


ZL.The newly created "Google Document" is saved and available to share as

required

htÞ! doc.qooql..(omi:b- .,i¿!thu:.r=¡=î3r.J p' l¡Cx

o lÞfe.. ;' T¡ms.. ¿lE rt.. l!eary... Jem,.. fì r ,m - P.9! ' l@þ r

¡ F \CSV Files\LadasCEllLocat¡ono4AC-dfCSV csv

otYilER LAll tlúújr r:l

ms 708pn'.

46

Appendix D: CV - Francis Graf

Francis Graf is the founder and former President and CEO of Forensic Dara Recovery Inc.where he was responsible for the company's srrategic business direction and corporatepriorÍties. He oversaw all digital forensic investigations and was dírectþ involved in themore complex eDiscovery and computer forensic consulting engagements. Mr. Graf hasextensive experience executing warrants in both civil and criminal cases and leadinginvestigations requirÍng comprehensive coordination. His end-to-end quality assuranceexpertise includes ensuring that proper digital forensic chain-of-custody procedureswere followed in order to maximize the evidentiary value of his findings. He regularlyconsulted with public and private sector organizations across Canada and the USA todevelop best practice policies and procedures in computer forensics.

Professional BackgroundMr. Graf is a former police officer and currentþ a Special Constable with the VictoriaPolice Deparrment. He has been involved in a wide range of hÍghly sensitive criminalÍnvestigations, including ch-ild pornography, murder, drug trafficking and organízedcrime activÍties. He also has experience delivering ex¡rert wítness testimony and beencourt-appointed as a Special, Master to provide counsel regarding computer forensicmethodologies and findings.

Mr. Graf and his team at Forensic Data Recovery Inc. worked closeþ with lawenforcement agencies across Canada and the United States. In his capacity as the seniordigrtal forensic Ínvestigator with FDR, Mr. Graf led over one hundred civÍlinvestigations, including: theft of Íntellecrual properrfi fraud; employee computermisuse; netn'ork intrusions; harassment of all t)T)es, and labor relations disputes. Mr.Graf also has extensive ex¡rerience assisting corporations and law fÍrms to manage allphases of the eDiscovery process. He regularþ assísted with the preparation ofcomprehensive preservation orders to meet clients' needs and ensure that all digtalevidence was properþ presewed, recoveted, analyzedand documented.

Mr. Graf is an EnCase@-certified examiner and trainer. As such, Mr. Graf has rrainedcomputer forensics practitioners from police deparrments, publíc and private sectororganízatÍons in Canada, the U.S., Indonesia and Saudí Arabia. Clients Íncluded theRoyal CanadÍan Mounted Police, the FBI and Homeland Securiry.

Mr. Graf is a member of the International Association of Computer InvestigativeSpecialists and holds the Association's Certificate Forensic Computer Examiner (CFCE).He has also coached other digital forensic examiners pursuing their CFCE credential.

Expert Witness (DigÍtal Forensics) Experience

Supreme Court of BritÍsh Columbia, Case: R v Roger Denley, Possession of childpornography, accessing child pornography, File no: 135567'2 2OOB

United States Disrrict Court Southern Disrrict of California, case number 04 CV 1968

rEG (LSP) 2006

Supreme Court of BrÍtish Columbia, Case: Bourne v Lilly, Nash, Ledbetter File no: 248722004

47


Publications

Computr Forensics Concept of Operations andProcedures IJsingEnCøse. Government ofCanada-Information Inlrastructurre Protection 2004Computer forensics-AnBssentiallnvestigativeToolin anElectronic Age, Conrinuing LegalEducatíon Sociery of BritÍsh Columbia, Employment Law Conference, ConferencematerialsTheReløtionshipBenveenSocialsupport øndOccupøtionøIStress AmongPoliceOft'icers

Journal of Police Science and Administration, Vol. 14, No. 3

PresentatÍons

DigltalForensicsforLøwyers - Continuing Legal Education Society of BCDigltølForensics - Saskatchewan Privacy and Security ConferenceDigitalForensicsforlnternalAuditors - Inst. of Internal Auditors National Conference

ComputerForensicsForlnvestigarors -Justice InstÍrute of BC Indonesia Police ProjectDigltølForensicsineDiscovery, Messrs. Waddell Raponi, Barristers and SolicitorsRecords Management and Digital Discovery Forum keymote presentationAdvocates LLP, Barristers and SolicitorsHarÍson Pensa LLP, Barrísters and SolicitorsEnCase Version 5 famlnrtzation briefings, Canadian Police CollegeOntario Bar Associarion Professional Development seminarPrivacy and Securiry conferenceAssociation of Certified Fraud Examiners International conferenceMiddlesex Law Association Continuing Legal EducationLegal Technology conferenceSociery for the Policing of Cyberspace conferenceCanadian Association of Forensic Investigators conferenceCorrections Services Canada conferenceB.C. Association of School Disrrict Human Resources Managers conferenceB.C. Human Resources Management Association conferenceB.C. Association of Police Boards conferenceEmployment Law conference, B.C. Contínuing Legal Education Society

Media Articles

Lost or stolendata: It canbet'ounQ Business Vancouver Island

Mouseclich cop bytes criminals, Vancouver Sun rwo-page feature

Best practices critical in digital forensics,Blue LineMagazine

20021986

20lt20r02010

200820062006200620062005200520052004200420032003200320032002200220022002

Nov.2006

JuIy 2006

June{uly 2006

48


Professional AffÍlÍatíons

Sedona Canada Working Group 7 - eDiscoveryFoundíngmember, High Technology Crime InvestigationAssocÍation, B.C. ChapterMember, SocÍeryfor the PolÍcing of CyberspaceMember, Internatíonal AssociarÍon of Computer Investigative SpecialistsMember, Computer Security InstiruteAssociate member, Association of CertifÍed Fraud ExaminersFaculry, Continuing Legal Educarion SocÍery of B.C. Employment Law Conference

Academic Credentials

MA, Psychology, University of VictoriaBSc, Psychology, Universiry of VÍctoriaDiploma, Police Officers General Training Program, B.C.Justice Instirute

Professional Certifications

EnCase-certified Examiner (EnCE)EnC ase-certifi ed InstructorIACIS-CFCE (International Association of Computer Investigative Specialísts)IACI S--CEEPS (Electronic EvÍdence Collection Specialist)A* Core Hardware and Operaring Systems

Digital Forensics Professional Development

iPhone Forensics Jan 2011

HTCIAAsia Pacific Training Conference - Hong Kong Dec 2009EnCase On-Demand eDiscovery Sep 2009CEIC Conference, LasVegas NV Apr 2008IACIS CFCE Recertification, Orlando FL Apr 2008HTCIA, ottawa, oN Feb 2ooZ

CEIC Conference, LasVegas, NV May 2006DNA and fingerpúnt presewation in examining cell phone and PDA exhibitsVictoria PolÍce Deparrment IdentÍfication section Jan 2006Advanced Mobile Telephone ForensÍcs, Sevenoaks, UK Oct.-Dec 2005Inrroductory Mobile Telephone Forensics, BCIT Oct. 2005

EnCase Expert Series Nerwork Intn¡sion, Guidance Sofrware Apr 2005Network Forensic Essentials, Digítal lntelligence Apr 2005

EnCase Advanced Forensic AnalysÍs and DÍscovery, Guídance Sofrware Aug 2003

EnCase Certified Examiner completion, Guidance Sofrware Feb 2003

EnCase Certified Instructor completion, Guidance Sofrware Dec 2002EnCase Expert Series Internet and Email examinations, Guidance Sofrware Apr 2002Chief Information Securiry Officer Certificate, Weber State University Aug 2002EnCase Computer Forensic Methodology, Guidance Sofrware Feb 2002Presenting Expert Witness Testímony on Electronic Evídence NTI Jan2002Computer Forensics and Securiry-Windows 9x and NTFS, NTI Nov 2001

49

Francis Graf report - Amanda Ladas vs. Apple case

Documents

Transcript of Francis Graf report - Amanda Ladas vs. Apple case