extraction report - nist...selected device name iphone 3gs unit identifier 5550494 unit version...

Extraction ReportCellebrite UFED Reports

SummaryConnection Type Cable No. 110

Extraction end date/time 2012-10-23T16:16:05

Extraction start date/time 2012-10-23T15:57:54

Report type Phone

Selected Manufacturer Apple

Selected Device Name iPhone 3GS

Unit Identifier 5550494

Unit Version Software: 1.2.2.3 UFED, Full Image: 1.0.2.9, Tiny Image: 1.0.2.1

UFED Physical Analyzer version 3.2.0.12

Examiner name iPhone3GS-Logical

Device Information# Name Value Del?

1 Bluetooth device address 04:1e:64:63:5a:832 Detected model MC1353 ICCID 890141042551875069104 IMEI 0119820097594615 IMSI 3104105187506916 MSISDN 1 (443) 714-01687 MSISDN Type MSISDN8 Phone revision 4.3.1 (8G4)9 Serial 879396L03NP10 Unique Device ID b76d7e121c1c4ff72c0af58a02c7da038beca1ca11 WiFi address 04:1e:64:63:5a:84

1

Plugins# Name Author Version

1 UFED Logical Report Reader Cellebrite 2.0

2 Physical Analyzer Report Reader Cellebrite 2.0

3 ContactsCrossReferenceCross references the phone numbers in a device's contacts with the numbers in SMS messages andCalls. Will fill in the Name field of calls and SMS if there's a match.

Cellebrite 2.0

4 DataFilesHandler Cellebrite 2.0

ContentsType Included in report Total

Call Log 22 22

Incoming 4 4

Missed 7 7

Outgoing 11 11

Contacts 11 11

Phone 11 11

MMS Messages 11 11

Inbox 2 2

Sent 9 9

SMS Messages 46 46

Inbox 19 19

Sent 27 27

Time line 79 79

Data Files 72 72

Audio 46 46

Images 26 26

Carved Files 0 0

Call Log (22)* These details are cross-referenced from this device's contacts

2

Incoming (4)

# Country code

Network code

Party Time Duration Video call

Source Del?

1 2404378277 Mr. Blond* 3/15/2012 6:44:22PM(UTC+0)

00:00:02

2 2404378277 Mr. Blond* 3/15/2012 6:44:42PM(UTC+0)

00:01:06

3 5402529108 Raine Aldo* 3/15/2012 6:56:13PM(UTC+0)

00:00:16

4 4437140164 Nokia Dcci* 10/19/2012 5:45:55PM(UTC+0)

00:02:17

Missed (7)

# Country code

Network code


Source Del?

1 3604601212 3/15/2012 9:14:21PM(UTC+0)

-

2 8009475096 3/19/2012 1:40:18PM(UTC+0)

-

3 8009475096 3/20/2012 1:08:14PM(UTC+0)

-

4 8009475096 3/20/2012 6:34:33PM(UTC+0)

-

5 8009475096 3/21/2012 1:05:11PM(UTC+0)

-

6 8009475096 3/21/2012 5:56:36PM(UTC+0)

-

7 8009475096 3/22/2012 1:06:13PM(UTC+0)

-

Outgoing (11)

# Country code

Network code


Source Del?

1 3016934106 Cherry Max* 3/15/2012 6:42:21PM(UTC+0)

-

2 4432548557 Floyd* 3/15/2012 6:42:37PM(UTC+0)

00:00:04

3 4436920337 Jules* 3/15/2012 6:42:55PM(UTC+0)

-

4 2404378277 Mr. Blond* 3/15/2012 6:43:30PM(UTC+0)

-

5 5402529108 Raine Aldo* 3/15/2012 6:43:49PM(UTC+0)

-

6 4432548557 Floyd* 3/15/2012 6:49:05PM(UTC+0)

00:00:18

7 +37254661813 3/15/2012 7:01:15PM(UTC+0)

-

8 5402529108 Raine Aldo* 3/16/2012 10:56:58AM(UTC+0)

-

9 5402529108 Raine Aldo* 3/16/2012 10:57:17AM(UTC+0)

-

10 5402529108 Raine Aldo* 3/16/2012 10:57:30AM(UTC+0)

-

11 4437140166 Blackberry Dcci* 10/19/2012 5:21:46PM(UTC+0)

00:02:29

3

Contacts (11)

Phone (11)

# Name Entries Del?

1

Apple Inc.

Entries (2)

Domain Category Value Del?

General 1800

http://www.apple.com

Addresses (1)

Category Address Del?

1 Infinite Loop, Cupertino, 95014

2 Android Dcci Entries (1)


Mobile +14436946702

3 Blackberry Dcci Entries (1)


Mobile 4437140166

4 Cherry Max Entries (1)


Mobile 3016934106

5 Eva Entries (1)


Mobile 2532412554

6 Floyd Entries (1)


Mobile 4432548557

7 Jules Entries (3)


Mobile 4436920337

Home [email protected]

Work [email protected]

8 MAC_Response_CT

9 Mr. Blond Entries (2)


Mobile 2404378277


10 Nokia Dcci Entries (1)


Mobile 4437140164

11 Raine Aldo Entries (2)


Mobile 5402529108


4

MMS Messages (11)

Inbox (2)

#

1No subject

Deleted: Intact Timestamp: 3/14/2012 7:51:12 PM(UTC+0) Priority: Normal Status: Read

From +12404378277

To

Name Mr. Blond

Cc

Bcc

Body file: message-1.txt MD5: 8246fa421fd3f20541540f3688c78b6f

2012-02-17_18.37.28.jpg

2No subject

Deleted: Intact Timestamp: 10/22/2012 4:06:22 PM(UTC+0) Priority: Normal Status: Read

From +14436946702

To

Name Android Dcci

Cc

Bcc

Body file: message-2.txt MD5: f3387af69b8f7f9c5550ce92123a90e8

100MEDIA$IMAG0001.jpg

Sent (9)

#

1No subject

Deleted: Intact Timestamp: 3/15/2012 10:24:25 AM(UTC+0) Priority: Normal Status: Sent

From

To +12404378277

Name Mr. Blond

Cc

Bcc

Body file: message-3.txt MD5: 5866398bbe45da8ad425db3aee14f72a

IMG_5813.jpg

5

messages/Inbox/message-1.txt

messages/Inbox/message_1_attachments/2012-02-17_18.37.28.jpg

messages/Inbox/message_1_attachments/2012-02-17_18.37.28.jpg

messages/Inbox/message-2.txt

messages/Inbox/message_2_attachments/100MEDIA$IMAG0001.jpg

messages/Inbox/message_2_attachments/100MEDIA$IMAG0001.jpg

messages/Sent/message-3.txt

messages/Sent/message_3_attachments/IMG_5813.jpg


2No subject

Deleted: Intact Timestamp: 3/15/2012 2:58:16 PM(UTC+0) Priority: Normal Status: Sent

From

To (443) 692-0337

Name Jules

Cc

Bcc

Body file: message-4.txt MD5: fe5b95feebb6f98f98fda4f26f0f0dd8

IMG_0005.jpg

3No subject


From

To (540) 252-9108

Name Raine Aldo

Cc

Bcc

Body file: message-5.txt MD5: 0a38992304a8f66ddaaeffa9266dce7b

IMG_5608.jpg

4No subject

Deleted: Intact Timestamp: 3/16/2012 11:19:52 AM(UTC+0) Priority: Normal Status: Sent

From

To (301) 693-4106, (443) 254-8557, (443) 692-0337, (240) 437-8277, (540) 252-9108

Name Cherry Max

Cc

Bcc

Body file: message-6.txt MD5: 8dea0485310885b3a4d70e126b1904cb

I've seen this guy hanging around the train car a little too often - everyone keep ur eyes open in case he's onto us

IMG_5725.jpg

6










5No subject


From

To (240) 437-8277

Name Mr. Blond

Cc

Bcc

Body file: message-7.txt MD5: f996e99178ec7caef1ba118724a030f9

Check gps - we can stay here

IMG_0570.jpg

6No subject


From

To (240) 437-8277

Name Mr. Blond

Cc

Bcc

Body file: message-8.txt MD5: dcf6ab3a7d90b19e5112f6908699c395

We can buy supplies

IMG_8774.jpg

7No subject


From

To (240) 437-8277

Name Mr. Blond

Cc

Bcc

Body file: message-9.txt MD5: 3097bb4b6abe19b9dbb7ee7a449c4a8c

Meeting place - use gps

IMG_3958.jpg

7










8No subject


From

To +14436946702

Name Android Dcci

Cc

Bcc

Body file: message-10.txt MD5: 8590ab2f2ab135d9ae6de7a074d6ad9c

IMG_5319.jpg

9No subject


From

To (443) 714-0166

Name Blackberry Dcci

Cc

Bcc

Body file: message-11.txt MD5: d2b71ed0cfd29017d7e234a705bc2392

IMG_3785.jpg

SMS Messages (46)* These details are cross-referenced from this device's contacts

Inbox (19)

# Party Time SMSC Status Message Del?

1 From: +13016934106 CherryMax

3/15/2012 12:57:52PM(UTC+0)

Read Confirmed

2 From: +15402529108 RaineAldo

3/15/2012 6:16:22 PM(UTC+0) Read Ok

3 From: +37254661813 3/15/2012 6:23:14 PM(UTC+0) Read YOU LOOKING FOR ME?

4 From: +12404378277 Mr. Blond 3/15/2012 6:38:37 PM(UTC+0) Read Understood

5 From: +37254661813 3/15/2012 6:41:48 PM(UTC+0) Read CALL ME CONTROL

6 From: 7535 3/19/2012 1:22:28 PM(UTC+0) Read Free AT&T Msg: Reminder, your bill is ready. Tryour payment options at www.att.com/olam or dial*PAY 866-339-6785 and press send to pay fromyour phone

7 From: 7535 3/22/2012 2:42:54 PM(UTC+0) Read Credit Card Payment Confirmation#QPCMAT829368829 for $247.23 paid 03/22/12posted to account 418039448022 on 03/22/12

8 From: +11113272607 10/17/2012 5:29:34PM(UTC+0)

Read AT&T Free Msg: Welcome to GoPhone! To learnmore about GoPhone data & text messagingfeatures, check your balance & refill your accountgo to att.com/mygophone

9 From: 7106 10/18/2012 2:05:26PM(UTC+0)

Read Winnie, thanks for buying your phone from Jamesat our AT&T store. We'll text you shortly for somefeedback. (SURVEY TEXTS FREE)

10 From: 7106 10/18/2012 2:06:16PM(UTC+0)

Read How satisfied were you with the service provided byJames our retail Rep - on a scale from 10(completely) to 1 (not at all)?

11 From: +14437140166Blackberry Dcci

10/19/2012 5:25:30PM(UTC+0)

Read Test successful

8







12 From: +14436946702 AndroidDcci

10/19/2012 5:28:30PM(UTC+0)

Read Hi

13 From: +14437140164 NokiaDcci

10/19/2012 6:19:39PM(UTC+0)

Read Good afternoon

14 From: +14437140164 NokiaDcci

10/19/2012 6:21:23PM(UTC+0)

Read Fine just sitting talking to myself

15 From: +14436946702 AndroidDcci

10/19/2012 7:18:57PM(UTC+0)

Read Columbia?

16 From: 7106 10/19/2012 7:20:00PM(UTC+0)

Read Happy to hear that. How likely would you be torecommend AT&T to a friend - on a scale from 10(definitely) to 1 (definitely not)?

17 From: 7106 10/19/2012 7:22:17PM(UTC+0)

Read Delighted you would recommend AT&T. Could youtell us why you gave that rating, or what was thebest part of your AT&T experience?

18 From: 7106 10/19/2012 7:23:51PM(UTC+0)

Read Thanks. One final question: How long did you waitfor a Sales Rep to assist you? a. Less than 5 minsb. 5-10 mins c. 10-15 mins d. 15-20 mins e. 20 +mins

19 From: 7106 10/19/2012 7:24:13PM(UTC+0)

Read Thanks again for your time and feedback. Yourcomments will help us continually improve ourstores & service.AT&T

Sent (27)

# Party Time SMSC Status Message Del?

1 To: +12404378277 Mr. Blond 3/14/2012 8:35:13 PM(UTC+0) Sent Got it

2 To: (540) 252-9108 Raine Aldo 3/15/2012 8:04:41 AM(UTC+0) Sent Dont forget to bring today do not drive urstudabaker and no valet parking

3 To: (301) 693-4106 Cherry Max 3/15/2012 8:45:24 AM(UTC+0) Sent WhiskeyZulu

4 To: (443) 254-8557 Floyd 3/15/2012 9:03:55 AM(UTC+0) Sent Met Fuy from Sriracha

5 To: (443) 254-8557 Floyd 3/15/2012 4:57:22 PM(UTC+0) Sent Do u have email yet F?

6 To: (540) 252-9108 Raine Aldo 3/15/2012 6:10:52 PM(UTC+0) Sent Hey don't forget to delete that image after u view it

7 To: +13016934106 Cherry Max 3/15/2012 6:11:30 PM(UTC+0) Sent M - u fruit - did u call Estonia yet?

8 To: (443) 692-0337 Jules 3/15/2012 6:11:53 PM(UTC+0) Sent Delete that photo after u view it

9 To: +12404378277 Mr. Blond 3/15/2012 6:12:17 PM(UTC+0) Sent It's time to move to phaze2

10 To: +37254661813 3/15/2012 6:25:14 PM(UTC+0) Sent Maybe - depends on who u are

11 To: +37254661813 3/15/2012 6:40:51 PM(UTC+0) Sent Oh yeah sorry now I remember u

12 To: +37254661813 3/16/2012 10:58:20AM(UTC+0)

Sent Control I tried to call u back yesterday - did my callgo through?

13 To: (443) 254-8557 Floyd 3/16/2012 10:58:46AM(UTC+0)

Sent Hello? F do u have an email address yet?

14 To: +12404378277 Mr. Blond 3/16/2012 3:29:32 PM(UTC+0) Sent IPA does not run in linux

15 To: (443) 254-8557 Floyd 3/16/2012 3:34:55 PM(UTC+0) Sent Ok am I texting to myself?

16 To: (443) 692-0337 Jules 3/22/2012 4:03:27 PM(UTC+0) Sent Did u get the email I sent to ur work address?

17 To: +37254661813 3/31/2012 5:52:55 PM(UTC+0) Sent We have a new target identified - will send pics anddata later

18 To: +12404378277 Mr. Blond 3/31/2012 5:57:57 PM(UTC+0) Sent New target identified - will update u ASAP

19 To: (443) 714-0166 BlackberryDcci

10/19/2012 5:20:20PM(UTC+0)

Sent Test

20 To: +14436946702 AndroidDcci

10/19/2012 5:30:19PM(UTC+0)

Sent What's up

21 To: +14437140164 Nokia Dcci 10/19/2012 6:20:13PM(UTC+0)

Sent Not much, how are things with you?

22 To: +14437140164 Nokia Dcci 10/19/2012 6:24:09PM(UTC+0)

Sent Sounds fascinating

23 To: 7106 10/19/2012 7:14:57PM(UTC+0)

Sent 10

9

24 To: +14436946702 AndroidDcci

10/19/2012 7:19:12PM(UTC+0)

Sent No thanks

25 To: 7106 10/19/2012 7:20:28PM(UTC+0)

Sent 10

26 To: 7106 10/19/2012 7:23:29PM(UTC+0)

Sent James was very helpful and made getting thesephones set up quick and painless. Attempting to setup a similar plan with sprint was more expensive forour needs and was much harder and more timeconsuming

27 To: 7106 10/19/2012 7:24:01PM(UTC+0)

Sent A

Time line (79)# Type Timestamp Party Description Del?

1 MMS Messages 3/14/2012 7:51:12PM(UTC+0)

+12404378277

2 SMS Messages 3/14/2012 8:35:13PM(UTC+0)

To: +12404378277 Mr.Blond

Got it

3 SMS Messages 3/15/2012 8:04:41AM(UTC+0)

To: (540) 252-9108Raine Aldo

Dont forget to bring today do not drive ur studabaker and no valetparking


To: (301) 693-4106Cherry Max

WhiskeyZulu


To: (443) 254-8557Floyd

Met Fuy from Sriracha

6 MMS Messages 3/15/2012 10:24:25AM(UTC+0) +12404378277


From: +13016934106Cherry Max

Confirmed

8 MMS Messages 3/15/2012 2:58:16PM(UTC+0) (443) 692-0337



To: (443) 254-8557Floyd

Do u have email yet F?


To: (540) 252-9108Raine Aldo

Hey don't forget to delete that image after u view it


To: +13016934106Cherry Max

M - u fruit - did u call Estonia yet?


To: (443) 692-0337Jules

Delete that photo after u view it


To: +12404378277 Mr.Blond

It's time to move to phaze2


From: +15402529108Raine Aldo

Ok


From: +37254661813 YOU LOOKING FOR ME?


To: +37254661813 Maybe - depends on who u are


From: +12404378277Mr. Blond

Understood


To: +37254661813 Oh yeah sorry now I remember u


From: +37254661813 CALL ME CONTROL

21 Call Log 3/15/2012 6:42:21PM(UTC+0)

3016934106 CherryMax

22 Call Log 3/15/2012 6:42:37PM(UTC+0)

4432548557 Floyd

23 Call Log 3/15/2012 6:42:55PM(UTC+0)

4436920337 Jules

24 Call Log 3/15/2012 6:43:30PM(UTC+0)

2404378277 Mr. Blond

25 Call Log 3/15/2012 6:43:49PM(UTC+0)

5402529108 Raine Aldo

26 Call Log 3/15/2012 6:44:22PM(UTC+0)

2404378277 Mr. Blond

27 Call Log 3/15/2012 6:44:42PM(UTC+0)

2404378277 Mr. Blond

28 Call Log 3/15/2012 6:49:05PM(UTC+0)

4432548557 Floyd

29 Call Log 3/15/2012 6:56:13PM(UTC+0)


10

30 Call Log 3/15/2012 7:01:15PM(UTC+0)

+37254661813

31 Call Log 3/15/2012 9:14:21PM(UTC+0)

3604601212

32 Call Log 3/16/2012 10:56:58AM(UTC+0)


33 Call Log 3/16/2012 10:57:17AM(UTC+0)


34 Call Log 3/16/2012 10:57:30AM(UTC+0)



To: +37254661813 Control I tried to call u back yesterday - did my call go through?


To: (443) 254-8557Floyd

Hello? F do u have an email address yet?

37 MMS Messages 3/16/2012 11:19:52AM(UTC+0) (301) 693-4106

(443) 254-8557(443) 692-0337(240) 437-8277(540) 252-9108

I've seen this guy hanging around the train car a little too often -everyone keep ur eyes open in case he's onto us


To: +12404378277 Mr.Blond

IPA does not run in linux


To: (443) 254-8557Floyd

Ok am I texting to myself?


From: 7535 Free AT&T Msg: Reminder, your bill is ready. Try our payment options atwww.att.com/olam or dial *PAY 866-339-6785 and press send to payfrom your phone

41 Call Log 3/19/2012 1:40:18PM(UTC+0)

8009475096

42 Call Log 3/20/2012 1:08:14PM(UTC+0)

8009475096

43 Call Log 3/20/2012 6:34:33PM(UTC+0)

8009475096

44 Call Log 3/21/2012 1:05:11PM(UTC+0)

8009475096

45 Call Log 3/21/2012 5:56:36PM(UTC+0)

8009475096

46 Call Log 3/22/2012 1:06:13PM(UTC+0)

8009475096


From: 7535 Credit Card Payment Confirmation #QPCMAT829368829 for $247.23paid 03/22/12 posted to account 418039448022 on 03/22/12


To: (443) 692-0337Jules

Did u get the email I sent to ur work address?


To: +37254661813 We have a new target identified - will send pics and data later


To: +12404378277 Mr.Blond

New target identified - will update u ASAP


Check gps - we can stay here


We can buy supplies


Meeting place - use gps


From: +11113272607 AT&T Free Msg: Welcome to GoPhone! To learn more about GoPhonedata & text messaging features, check your balance & refill your accountgo to att.com/mygophone


From: 7106 Winnie, thanks for buying your phone from James at our AT&T store.We'll text you shortly for some feedback. (SURVEY TEXTS FREE)


From: 7106 How satisfied were you with the service provided by James our retailRep - on a scale from 10 (completely) to 1 (not at all)?


To: (443) 714-0166Blackberry Dcci

Test

58 Call Log 10/19/2012 5:21:46PM(UTC+0)

4437140166 BlackberryDcci


From: +14437140166Blackberry Dcci

Test successful


From: +14436946702Android Dcci

Hi


To: +14436946702Android Dcci

What's up

62 Call Log 10/19/2012 5:45:55PM(UTC+0)

4437140164 Nokia Dcci


From: +14437140164Nokia Dcci

Good afternoon


To: +14437140164Nokia Dcci

Not much, how are things with you?

11


From: +14437140164Nokia Dcci

Fine just sitting talking to myself


To: +14437140164Nokia Dcci

Sounds fascinating


To: 7106 10


From: +14436946702Android Dcci

Columbia?


To: +14436946702Android Dcci

No thanks


From: 7106 Happy to hear that. How likely would you be to recommend AT&T to afriend - on a scale from 10 (definitely) to 1 (definitely not)?


To: 7106 10


From: 7106 Delighted you would recommend AT&T. Could you tell us why you gavethat rating, or what was the best part of your AT&T experience?


To: 7106 James was very helpful and made getting these phones set up quickand painless. Attempting to set up a similar plan with sprint was moreexpensive for our needs and was much harder and more timeconsuming


From: 7106 Thanks. One final question: How long did you wait for a Sales Rep toassist you? a. Less than 5 mins b. 5-10 mins c. 10-15 mins d. 15-20mins e. 20 + mins


To: 7106 A


From: 7106 Thanks again for your time and feedback. Your comments will help uscontinually improve our stores & service.AT&T

77 MMS Messages 10/22/2012 4:06:22PM(UTC+0)

+14436946702

78 MMS Messages 10/23/2012 6:35:25PM(UTC+0) +14436946702


Data Files (72)

Audio (46)

# File Info Del?

1 Name: ADNR.mp3Path: /iTunes_Control/Music/ADNR.mp3MD5: 68e067d6c370a304a802cbb68839d28cSHA256: 10dd37d7fe1c5446975580b51e9a8582

1d5b142f54fd365ef0daebe869cef02b

Size (Bytes): 8413203Created: 3/16/2012 1:43:53 PM(UTC+0)

2 Name: AJRO.mp3Path: /iTunes_Control/Music/AJRO.mp3MD5: c158700d4d115dbce39701a5531031ddSHA256: cc3ebbf0bfc97e54d8e846e99db065bd

c9b08c7197aa734bcf2dde6258323e04


3 Name: BQID.m4aPath: /iTunes_Control/Music/BQID.m4aMD5: c3f93ec7c266ce0fba90f506814fa587SHA256: 01caa81889d9ac1481e63cf608e6128f

11a7d7db56ad8999b9fcce4de2c0b697


4 Name: CRTE.mp3Path: /iTunes_Control/Music/CRTE.mp3MD5: f02b99d8e9235974176fab63c3801e7fSHA256: 23d4dc1f92099f7e98bf35322a75f06f

ebead79a04a2adc1abe893b55cdba743


5 Name: CRUP.m4aPath: /iTunes_Control/Music/CRUP.m4aMD5: 4b07134d33d20ef6b12a9fc23e789e9dSHA256: dd4283c50937319863df56d277b22a57

852f9ae7842b4b61fd37444dfc73dd00


12

files/Audio/ADNR.mp3

files/Audio/AJRO.mp3

files/Audio/BQID.m4a

files/Audio/CRTE.mp3

files/Audio/CRUP.m4a

6 Name: DCEM.m4aPath: /iTunes_Control/Music/DCEM.m4aMD5: 2e195230c09f368fa5e64633271c0bbeSHA256: db547ad59de77d09c9998dca45d69983

20e86f81cc1f424f5e81f03ccb74179a


7 Name: DHAK.mp3Path: /iTunes_Control/Music/DHAK.mp3MD5: 3c1c79a9bda8dbf6590273ac4fd867d1SHA256: 7903d3612da01d79f10f3f778618890c

c1de11da269a9983d00aa3d7f40db5f2


8 Name: DWGG.mp3Path: /iTunes_Control/Music/DWGG.mp3MD5: e5934112117563df78e1b7a2c34833f1SHA256: 16b8766932c9ef93c0e88c8dab4a7638

80645ab8a07b4218035a860508d71465


9 Name: DZHU.m4aPath: /iTunes_Control/Music/DZHU.m4aMD5: 48ef309b0c9dffc92e6e90a648d828e6SHA256: 1433328e105f53927c61af660e738502

8fc245020b844ac9aacb9b94a41b4538


10 Name: EMON.mp3Path: /iTunes_Control/Music/EMON.mp3MD5: 990ab09e646ffd8d12d7c02834281605SHA256: 979ad54e8177e7bf1a4e657bb9a7a69f

5aece5dd81369e0b3b89f6148ed4939b


11 Name: EPEX.mp3Path: /iTunes_Control/Music/EPEX.mp3MD5: c6c5a8f37c298876e19583098adaf213SHA256: d195c33b034ddd0be9dfd7030571c64d

85de6f393d05d73d723b48bb5e51fb59


12 Name: FUJV.m4aPath: /iTunes_Control/Music/FUJV.m4aMD5: 8b153c22601902950b684b42fad1eec3SHA256: 6b75a987f2a8a1d6af3149d099000e14

ff148319683cc2a43753ba205e0a3ca0


13 Name: FZLO.mp3Path: /iTunes_Control/Music/FZLO.mp3MD5: 977d0402257bdc99032b321a47eb6d57SHA256: dbf7b9aa521a83d5a79f3d6159e95157

da538258ceec75bf262ecfcfe0d7c0b1


14 Name: GIHQ.mp3Path: /iTunes_Control/Music/GIHQ.mp3MD5: 04a7cab902954e8b7215ede517ae1251SHA256: acc26da9434ec38752eec990a60834e8

fd11ecd8af1def8f5d7f108f13e4c1ce


15 Name: GKKW.mp3Path: /iTunes_Control/Music/GKKW.mp3MD5: 52e0824e2e720f1f468150796baadb7cSHA256: 1c03e6cf3287c3c8f8fd6fdad57c7ff1

4c32a137edc776e683f9e610a2cee5c6


16 Name: GUHQ.mp3Path: /iTunes_Control/Music/GUHQ.mp3MD5: 5b97e14b3eaa493bf7469743102b86fbSHA256: 8c3d17c0bf7a328fb9e5765b22417491

57065696ffb20ad1a102d568ca4fcce9


13

files/Audio/DCEM.m4a

files/Audio/DHAK.mp3

files/Audio/DWGG.mp3

files/Audio/DZHU.m4a

files/Audio/EMON.mp3

files/Audio/EPEX.mp3

files/Audio/FUJV.m4a

files/Audio/FZLO.mp3

files/Audio/GIHQ.mp3

files/Audio/GKKW.mp3

files/Audio/GUHQ.mp3

17 Name: GWHA.mp3Path: /iTunes_Control/Music/GWHA.mp3MD5: 75c184415289243c096650e5d8461048SHA256: 8c6dc3ed18eb88cc136529436dfd421f

47bd26ba01012e3194e9fb170b386c5e


18 Name: IBYS.m4aPath: /iTunes_Control/Music/IBYS.m4aMD5: 8c83837bf6a7fce66beb3e44ad5cc20cSHA256: 736e239777848f33a64d9dcc6a220d8c

f1c2568daa386ef65788b79e72929295


19 Name: IQJZ.m4aPath: /iTunes_Control/Music/IQJZ.m4aMD5: 2ff51523258d99f070d0b5d04af78b74SHA256: 5fe1e84197422e36761ec9f49b9f3a74

911b73afcb51e06332ac80d07171de17


20 Name: ISLN.mp3Path: /iTunes_Control/Music/ISLN.mp3MD5: db175d5b062f942f9e5897c5eb3304eaSHA256: 5dbb7e91009585f6c43350dfba2e419c

4db42f56350b125b0f2c860e50b97bcf


21 Name: JJFM.m4aPath: /iTunes_Control/Music/JJFM.m4aMD5: 427d49381e9556a52a664632cabec13fSHA256: debd0461ce7428ea19ee2c9aea29f5ff

edb8bcfaa1bdadf0f03631f1f11e9f0d


22 Name: KQSG.m4aPath: /iTunes_Control/Music/KQSG.m4aMD5: 119cb58fbd15551cd7786c0a101cc644SHA256: 1a419423e6a887e02bda90d5727fae85

c128554675ea40b10480480343833f5d


23 Name: KSHO.m4aPath: /iTunes_Control/Music/KSHO.m4aMD5: 3a8eb80aa4dba469f8ff4868537f2b5eSHA256: 47c8616905def61b2826710e7f5459e1

d256c2b5d1bdbc78244bf7d1b4ae3684


24 Name: LAAJ.mp3Path: /iTunes_Control/Music/LAAJ.mp3MD5: 2346f3ddedb43bb4100d0339503f4d4cSHA256: 5dcdb50f1ec4406dd24b3eda7175301c

7d7b7b292ade72de4ed2b4a929ba1c7c


25 Name: LXJJ.m4aPath: /iTunes_Control/Music/LXJJ.m4aMD5: c46df12615768299cd76c6637b7efd5eSHA256: 5e71951d0d25031f8fbc80f2a78a5d55

d528bd18a5865cba552725788730bd5d


26 Name: MEQZ.mp3Path: /iTunes_Control/Music/MEQZ.mp3MD5: 0928a77518b87470570ce669c2f275b5SHA256: ca014b1cfdaca7456dffb4c07b3bcca6

6171621796d8fd6dcf31f6461cecb6fa


27 Name: NUVT.m4aPath: /iTunes_Control/Music/NUVT.m4aMD5: 0314f83de26dc86140a359876d0bdd3cSHA256: d44a59acd0ff3108222accd3c40041fa

9b202100d50c58e7030232642e4171e5


14

files/Audio/GWHA.mp3

files/Audio/IBYS.m4a

files/Audio/IQJZ.m4a

files/Audio/ISLN.mp3

files/Audio/JJFM.m4a

files/Audio/KQSG.m4a

files/Audio/KSHO.m4a

files/Audio/LAAJ.mp3

files/Audio/LXJJ.m4a

files/Audio/MEQZ.mp3

files/Audio/NUVT.m4a

28 Name: OKNM.mp3Path: /iTunes_Control/Music/OKNM.mp3MD5: 35d39d9c9d66e96c1bf0fd02fb7b8de1SHA256: 0822a7330e1b449427bc53b6e594c780

aa28b6257185492912526456e6bbe106


29 Name: PWOF.m4aPath: /iTunes_Control/Music/PWOF.m4aMD5: 8a2bb9c1ab4824ed815959d8cc054057SHA256: c3f79dfa37934f66f2055dedfe22eb92

c52b06f83b45c3da081f1dc5e263b36f


30 Name: QFCW.m4aPath: /iTunes_Control/Music/QFCW.m4aMD5: e096f779f5c0f30d6b1dce356d986b8cSHA256: c4975a0e052f2b85360d49ce75e7b63b

dfe550f2f9cea37494bd42374ce2ce57


31 Name: QOGX.mp3Path: /iTunes_Control/Music/QOGX.mp3MD5: 2bf0fc475b1f41c5539698f252912c82SHA256: 2e6da67b0cf3476436d32c33553d10ad

c881131dcaefbae4f8fc2e6f19df0351


32 Name: QXXQ.m4aPath: /iTunes_Control/Music/QXXQ.m4aMD5: 5638beeb1a90e4b9a88e8a2106dba268SHA256: 02ddc663e3afedf230cc3d63ed2df095

ac00ca0e33f87449a3bd4dae82c69027


33 Name: QZKC.m4aPath: /iTunes_Control/Music/QZKC.m4aMD5: 78f3d1fa0df1927819c585b7d8d583c2SHA256: bdccb68650b14e0d7d4270e799987f9c

db1a167b565c6f4dc033f31762e346eb


34 Name: RFGI.m4aPath: /iTunes_Control/Music/RFGI.m4aMD5: 631e32b5484d236020248188e2f7227dSHA256: c2e109266a4e85e6fd491b37c6274d88

063e609bb5bc826678ad26af6ca34397


35 Name: RHCC.m4aPath: /iTunes_Control/Music/RHCC.m4aMD5: 72012b4ac95497a6a5e245f268da68c9SHA256: 0db3ea890cd4a80b3fb4d488bfbbc349

30adc9dfe0406410cba27273e67837dc


36 Name: SMBA.mp3Path: /iTunes_Control/Music/SMBA.mp3MD5: 7cb6ddb8b09a112f1ebd830066c60bc5SHA256: a37fd3cbc9876aa57a1e175a12f9af28

0c4eb427593f7a5a0cb204104aa0e4ae


37 Name: TWAH.mp3Path: /iTunes_Control/Music/TWAH.mp3MD5: 5dbd9515efd29666381d58e252e2d605SHA256: fd50d353182d6b877dddb6ff58f8da87

66994278cad8ae2decf021a353e682b8


38 Name: TZIC.mp3Path: /iTunes_Control/Music/TZIC.mp3MD5: 736b66f2dd728e29bf900bd4e2f54b10SHA256: f7a1b505ba2f44571c16f8155d9be02d

b8ec003847bd6e474e4386e8efdb54bf


15

files/Audio/OKNM.mp3

files/Audio/PWOF.m4a

files/Audio/QFCW.m4a

files/Audio/QOGX.mp3

files/Audio/QXXQ.m4a

files/Audio/QZKC.m4a

files/Audio/RFGI.m4a

files/Audio/RHCC.m4a

files/Audio/SMBA.mp3

files/Audio/TWAH.mp3

files/Audio/TZIC.mp3

39 Name: UMEH.mp3Path: /iTunes_Control/Music/UMEH.mp3MD5: b4acbeb1620d95b1414c7c4177dc3559SHA256: 91f24cacb7edc6d7a6cbce7f4a92f800

ec186f1a50d7c15931faa43d57198253


40 Name: UNDT.mp3Path: /iTunes_Control/Music/UNDT.mp3MD5: 509df66207a91f02e23a06ab61bdf031SHA256: 2fbebe8506e1e17c1895b274aec5e54a

97e7e3d1f9a0036b75a0948fcb153b98


41 Name: VIRO.m4aPath: /iTunes_Control/Music/VIRO.m4aMD5: ba446f50cba9cabe973869904a4df43bSHA256: e731469f84f3c202e993aa6465d534d5

d1526abcd152d5f8fa2a8eaf0cacae7c


42 Name: WTCZ.mp3Path: /iTunes_Control/Music/WTCZ.mp3MD5: 2b2fcfe980cfd1adda73d7fa616a47c2SHA256: 668e27627850ad40e06d238c016e0957

b6b78493d25651425c02cf9cb53b7a6f


43 Name: XBKU.mp3Path: /iTunes_Control/Music/XBKU.mp3MD5: 06ce05a4b3df87e68284ec087e042376SHA256: fe14e21bf3d0a245098da1bf0095b162

490adab0d53120c0acf28a36ae4b3f48


44 Name: YBFJ.mp3Path: /iTunes_Control/Music/YBFJ.mp3MD5: 5e4ddce2672439ed5f74c6efad0016ddSHA256: 4d53e98001298df30a2e61deb27e33a2

c1ce392d6f12e087b097d22a308846db


45 Name: YYMC.mp3Path: /iTunes_Control/Music/YYMC.mp3MD5: 69eacf4a7a46589a5e9f5d25aac7dc4dSHA256: 925d41cee38996c37a45f7f8a5d63f23

0983b9fcbd0372917ee622e3331ae5d7


46 Name: ZAEG.m4aPath: /iTunes_Control/Music/ZAEG.m4aMD5: 6c4ef2da7cb61b3ea27f373c334ff276SHA256: a4e2b146d1ca09aaa16b433142d0a529

e5a112519c1bb25cb41b08b689a5e2d7


16

files/Audio/UMEH.mp3

files/Audio/UNDT.mp3

files/Audio/VIRO.m4a

files/Audio/WTCZ.mp3

files/Audio/XBKU.mp3

files/Audio/YBFJ.mp3

files/Audio/YYMC.mp3

files/Audio/ZAEG.m4a

Images (26) Open in Google Earth

# File Info Thumbnail Del?

1 Name: 100MEDIA$IMAG0001.jpgPath: /100MEDIA$IMAG0001.jpgMD5: 8d8f93b73ab548dc54857ddaf93cf023SHA256: 9bc323ab30c8fc901d2d7964fc056794

24404727007d06f8ba6086a4403bc312

Size (Bytes): 30981

2 Name: 2012-02-17_18.37.28.jpgPath: /2012-02-17_18.37.28.jpgMD5: fade142d42eccb2b7beca6e20edb6ff2SHA256: 3bb49fb4f3701ad67acc4c46d70d291e

d2429f7136c7a6e72d41e4214a40b820

Size (Bytes): 18323

3 Name: IMG_0001.JPGPath: /DCIM/IMG_0001.JPGMD5: dde9fa0ac4f928fac4ccaf8fe0183410SHA256: 80dd67a96788cb96f6b387cdc49dcef9

ae2013b2e3882cd57d9dfb81e5cc5abe

Size (Bytes): 1157481Created: 3/15/2012 10:23:44 AM(UTC+0)Meta Data:Camera Make: Apple

Camera Model: iPhone 3GS

Capture Time: 3/15/2012 6:23:44 AM

Lat/Lon: 39.559000 / -76.072500

Pixel resolution: 2048x1536

Resolution: 72x72 (Unit: Inch)

4 Name: IMG_0002.JPGPath: /DCIM/IMG_0002.JPGMD5: 883fabcd0a50746368eaff09b9c5f406SHA256: 8f8a73f3c17e8f86dc63a8d335e29b0e

fc1cbb77d64493a75864e577ae7ff0c5



Capture Time: 3/15/2012 6:23:53 AM

Lat/Lon: 39.558167 / -76.072667



5 Name: IMG_0003.JPGPath: /DCIM/IMG_0003.JPGMD5: 37206ac3522a188cbe13319083085e4fSHA256: fdd49d1e95d1310b52f2218247033e60

d44d422644367ce7a309f0a57e7e3cec

Size (Bytes): 1616344Created: 3/15/2012 2:57:48 PM(UTC+0)Meta Data:Camera Make: Apple


Capture Time: 3/15/2012 10:57:47 AM

Lat/Lon: 39.207833 / -76.688167



6 Name: IMG_0004.JPGPath: /DCIM/IMG_0004.JPGMD5: c7012a79404cc9ddeff31d6c7ef9ead6SHA256: 6d2552af52555919938e8f84a163efcb

d97ba70b3f6817eeb3cf5284e805207d



Capture Time: 3/15/2012 10:59:50 AM

Lat/Lon: 39.207000 / -76.689333



17

gps/images.kml

gps/images.kml

files/Image/100MEDIA$IMAG0001.jpg

files/Image/100MEDIA$IMAG0001.jpg

files/Image/2012-02-17_18.37.28.jpg

files/Image/2012-02-17_18.37.28.jpg

files/Image/IMG_0001.JPG

http://maps.google.com/maps?q=39.559,-76.0725











7 Name: IMG_0006.JPGPath: /DCIM/IMG_0006.JPGMD5: 337ea897a1ae6897e67b6527caf3866eSHA256: 8f6e1944ee57da5d3fa646343701842c

a17d62738ce901845506b2e52afee431



Capture Time: 3/16/2012 7:17:59 AM

Lat/Lon: 39.312167 / -76.617167



8 Name: IMG_0007.JPGPath: /DCIM/IMG_0007.JPGMD5: ff374b785be8182ef294c7816cb58b97SHA256: 1f8f121e34fd472fcadb318683cef7c6

4be3572247b8ec34458ed0702140ddf8



Capture Time: 3/22/2012 10:38:57 AM

Lat/Lon: 39.205167 / -76.688000



9 Name: IMG_0008.JPGPath: /DCIM/IMG_0008.JPGMD5: 32e668cc14ddd6f986b0462cb1da1a14SHA256: 8f26d1938a20ef0302b12a09966d0ba3

a999e4da6d0de1c55ef22c97806de99d



Capture Time: 4/1/2012 11:33:28 AM

Lat/Lon: 35.598833 / -77.378167



10 Name: IMG_0009.JPGPath: /DCIM/IMG_0009.JPGMD5: 807da13d3f176b1a6dd52f846f1b8764SHA256: fedda185a1e16526457dd7e3e12690a8

3e269ad046b866b37a1f39ae77a8d788



Capture Time: 4/1/2012 11:37:47 AM

Lat/Lon: 35.191000 / -78.979667



11 Name: IMG_0010.JPGPath: /DCIM/IMG_0010.JPGMD5: a968477b0bc77722aba9d6880b68b515SHA256: 4b40a811792eaa3e01fc574207cb5dc9

1229e247a82f093334f2f669aed4ed2c



Capture Time: 4/1/2012 12:12:31 PM

Lat/Lon: 35.064333 / -79.017667



18
















12 Name: IMG_0011.JPGPath: /DCIM/IMG_0011.JPGMD5: a096af73bebbcd20b1f23854c00e8afcSHA256: 2fa0ec53a8f0fe27a95c6cc1edfc45d8

43e4cc7cc004af183e502ed352540fd9



Capture Time: 4/2/2012 12:29:12 PM

Lat/Lon: 35.158333 / -78.995500



13 Name: IMG_0012.JPGPath: /DCIM/IMG_0012.JPGMD5: 65ba9247bb83c2426604f8a046950148SHA256: 675a11f89590c2cc894bc4b633cd4066

053bbcedbbca5036646b0580a7a29ce3



Capture Time: 4/2/2012 12:29:13 PM

Lat/Lon: 35.158333 / -78.995500



14 Name: IMG_0013.PNGPath: /DCIM/IMG_0013.PNGMD5: d0e8f095513c9f71d87a74dc2dcf16bbSHA256: dec0889656bd0dded39b5c0e7f398eb2

d8d45d0ec233be287301901f5e6b6347

Size (Bytes): 229916

15 Name: IMG_0014.JPGPath: /DCIM/IMG_0014.JPGMD5: 09e8bf2157024d2a033a24c865a0bf33SHA256: eff2a25c0cf05bfecd2afde2cd8c1c52

9fcb80210487f79dee4b51b2cb3fc16f



Capture Time: 10/23/2012 2:35:07 PM



16 Name: IMG_0015.JPGPath: /DCIM/IMG_0015.JPGMD5: 74b7323ee9d6f8055f606f3543cc88cfSHA256: e7405df5b7ef9dbe14fef1c772ec8b0b

4d70599ddb362c90cbedd14d5e4eb348



Capture Time: 10/23/2012 2:36:35 PM



17 Name: IMG_0005.jpgPath: /IMG_0005.jpgMD5: 89c971876600960cb337806f828370e2SHA256: 1639f8223e19fb5b328e173c93f97427

bf922413909f281b1e031f8690e563a8

Size (Bytes): 383407Meta Data:Pixel resolution: 768x1024

19







files/Image/IMG_0013.PNG

files/Image/IMG_0013.PNG





files/Image/IMG_0005.jpg


18 Name: IMG_0570.jpgPath: /IMG_0570.jpgMD5: 87c533384910492d366294fc2dcb16d3SHA256: c7700e52abf369b0f7f01e595fe7de4d

824ab4d47b7db653a54274ab2a9218e1


19 Name: IMG_3785.jpgPath: /IMG_3785.jpgMD5: eeb6c77cc174026e9e372ec475fed789SHA256: d64e2e56a6062fff155df2774df49ed9

50e487ffed0b5f53d7bc0f3e80c24194


20 Name: IMG_3958.jpgPath: /IMG_3958.jpgMD5: 795948b5f6129f79f586984172726d0eSHA256: 6d65343149109b9815f0186316e090f8

33738ba47668a91dc3b36df0d4b9530b


21 Name: IMG_5319.jpgPath: /IMG_5319.jpgMD5: 2b1891b01701bef502d50807880e64c9SHA256: 8836b57962cd6934a3e2a1d6277e47b3

4a8b45b37b7ee484c4626b41153b4575


22 Name: IMG_5608.jpgPath: /IMG_5608.jpgMD5: 435eaa54e87023da85804888d7e9a85eSHA256: aec2c56228079187cc46692b3ba85bab

294c032bc7699f47ed308af684f49267


23 Name: IMG_5725.jpgPath: /IMG_5725.jpgMD5: 51055578ddd88bf057ac68e7b9f71414SHA256: eb474145934d5ff1355ac99301a7a845

85832c917bb85877b71d3141ae3d347d


24 Name: IMG_5813.jpgPath: /IMG_5813.jpgMD5: ddba9cd1ba2cbdaed53cb025d0c71089SHA256: f60620965c6f538c704b1917111bf486

f1545ccf4dd423acf8fdfe318ce3d6b7


20















25 Name: IMG_8774.jpgPath: /IMG_8774.jpgMD5: 9dda3f6a678f702ca3244ac9f16779baSHA256: c0de5672b2ba1928628c6df942e37ba3

ad0cd1d107eba509f329c83f6ac0db91


26 Name: PreviewWellImage.jpgPath: /PhotoData/PreviewWellImage.jpgMD5: 1ddc68ad79c0253046b8a85f65aa1061SHA256: c124222e89362fbe56f1597a3fa823bc

1571d5036d451675f3935687079cd387

Size (Bytes): 1873Created: 10/23/2012 6:36:40 PM(UTC+0)Meta Data:Pixel resolution: 37x37

21



files/Image/PreviewWellImage.jpg

files/Image/PreviewWellImage.jpg

extraction report - nist...selected device name iphone 3gs unit identifier 5550494 unit version...

Documents