Belhaven Pileum Report - Redacted

PILEUM Corporation
Investigative Project Report
CONFIDENTIAL
Page 1 of 26
Table of Contents
Executive Summary ............................................................................................................................................................ 3
Findings Summary ............................................................................................................................................................. 4
iPhone Examination........................................................................................................................................................... 5
Communications Between Erica Stewart and Tarold Durham ................................................................................. 8
Examination of Image Provided by Plaintiff on May 31, 2017 .............................................................................. 8
5005.JPG.full_image_2955_2956 ................................................................................................................... 10
5005.JPG.full_image_2957_2958 ................................................................................................................... 11
5005.JPG.full_image_3647_3648 ................................................................................................................... 12
5005.JPG.full_image_2454_2455 ................................................................................................................... 13
5005.JPG.full_image_3256_3257 ................................................................................................................... 14
5005.JPG.full_image_3150_3151 ................................................................................................................... 15
IMG_3345.JPG.2441_32000_125_125_516 ............................................................................................. 16
IMG_3792.JPG.2441_32000_125_125_517 ............................................................................................. 16
IMG_3792.JPG.full_image_2018_2249 ....................................................................................................... 17
IMG_3791.PNG.2441_32000_125_125_515 ........................................................................................... 19
IMG_3791.PNG.full_image_2018_2248 ..................................................................................................... 20
IMG_0112.JPG.2441_32000_125_125_7 .................................................................................................. 20
Conclusion ........................................................................................................................................................................ 25
Appendix A Chain of Custody Form ...................................................................................................................... 26
Page 2 of 26
Executive Summary
Pileum Corporation Pileum was engaged to conduct a digital forensics investigation related
to the iPhone used by Ms. Erica Stewart, an image that was presented by Plaintiff on May
31, 2017, and the Plaintiffs iCloud. Pileum received Ms. Erica Stewarts iPhone and iCloud
information at Pileum Corporations Office located at 190 E Capitol Street Suite 175
Jackson, MS 39201 on the morning of June 8th 2017. Ms. Stewart provided Pileum with all
usernames, passwords, and unlock pin needed to conduct the examination. A completed chain
of custody form is included in this report.
The goals were to recover all communications between Ms. Stewart and Tarold Durham from
Ms. Stewarts iPhone, to examine Ms. Stewarts iCloud account, determine an activation date
for Ms. Stewarts iPhone, and to forensically preserve and examine the image presented on
May 31, 2017 by the Plaintiff, as well as any images that may have been exchanged between
Ms. Stewart and Mr. Durham. Pileum was tasked with determining if an Activation date
can be determined from information retrieved from this device.
This examination includes a review of any images exchanged, to examine the metadata of such
images for any additional information including dates and times of the creation, and the dates
and time of any deletions and/or alterations. Pileum was provided the image that was
presented on May 31, 2017 by the Plaintiff and tasked with attempting to locate this image
on Ms. Stewarts iPhone and iCloud to retrieve and determine a creation date as well any
modifications to the image.
An iCloud examination was also performed to determine if any communications between Mr.
Durham and Ms. Stewart, including any images that may have been exchanged, can be
recovered. This examination also includes all metadata recoverable for any relevant images,
including the image that was presented by the Plaintiff on May 31, 2017.
It was also requested that Pileum provide any evidence of any altering or deleting of any data
from Ms. Stewarts iPhone or iCloud account between May 30, 2017 and the date of this
order.
Page 3 of 26
Findings Summary
Pileum Corporation utilizes multiple mobile forensic tools for preserving and examining
data on digital devices. During examination, it is noted that Ms. Stewarts iPhone remained
powered on from when dropped off to preserve flash memory from being overwritten. An
iTunes backup was first created to capture an image of the As Is state of the phone.
Pileum then used Mobilyze 2017 v1 by BlackBag Technologies to create the first image of
Ms. Stewarts iPhone which captured and preserved all communications on the phone, as
well as all images from message attachments and images saved locally on the phone to the
iPhone photos album. An image was also taken with Wondershare Dr. Fone for IOS to
attempt to recover or undelete any communications or texts between Ms. Stewart and Mr.
Durham.
Pileum then logged into and accessed Ms. Stewarts iCloud account from a secured
Forensics Server to forensically examine and discover communications between Ms. Stewart
and Mr. Durham, as well as recover and provide all metadata pertaining to any recoverable
images that were exchanged between Ms. Stewart and Mr. Durham. Using the Serial #
from Ms. Stewarts iPhone Pileum was able to determine activation information of Ms.
Stewarts iPhone. On the pages following, Pileum will provide evidence which was retrieved
during examination of Ms. Stewarts iPhone, iCloud, and Image provided by the Plaintiff
on May 31, 2017.
Page 4 of 26
iPhone Examination
Mobilyze forensics tool captured all information from Ms. Stewarts phone. The
information below listed as Device Details is extracted directly from Ms. Stewarts
iPhone.
Device Details
iPhone
Manufacturer Apple
Name iPhone
Type iPhone 6s Plus
Model MKUH2
Software Version 10.2

Phone Number
UDID
Capacity 12 GB Used (1 GB Free)

Bluetooth MAC
Wifi MAC
Time Zone America/Chicago
Acquisition Started 2017-06-08
Acquisition Ended 2017-06-08
Utilizing this information Pileum retrieved warranty information directly from Apples
website. Using Apples One Year Limited Warranty information and Ms. Stewarts
iPhones warranty expiration date, Pileum determined that this phone was activated at or
around August 20, 2016. See images for Warranty Expiration date from website
https://checkcoverage.apple.com as well as a screenshot of Apples One Year Limited
Warranty from website https://www.apple.com/legal/warranty/products/ios-warranty-
document-us.html.
Page 5 of 26
Image 1: Screenshot of Apples One Year Limited Warranty Information for Ms. Stewarts
iPhone.
Page 6 of 26
Image 2: Screenshot from Apples One Year Limited Warranty information on Apples
Website.
Page 7 of 26
Communications Between Erica Stewart and Tarold Durham
Using multiple forensics tools designed to extract information and to recover deleted texts
Pileum was unable to recover any communications between Erica Stewart and Tarold
Durham on Ms. Stewarts iPhone provided for the examination. Pileum was unable to
recover communications discovered between Ms. Stewart and Mr. Durham during the
examination of Ms. Stewarts iCloud account. This indicates that either any
communications possibly made between Ms. Stewart and Mr. Durham were deleted and
overwritten on the flash storage by new data making the deleted data unrecoverable, or that
no such communications existed on this iPhone.
Examination of Image Provided by Plaintiff on May 31, 2017
Pileum was provided a copy of the image submitted by Plaintiff on May 31, 2017. During
the transfer of this image the metadata of the image was overwritten, which is normal when
the copying of images takes place to provide an easily transferable image. Pileum used
exiftools to retrieve all metadata associated with this copy of an image. Image 3 below is a
screenshot of the copy of the image submitted by Plaintiff on May 31, 2017 with an export
of this images metadata.
Page 8 of 26
Image 3: Image submitted by Plaintiff on May 31, 2017 with metadata.
Note in Image 3 above, the file modification date and file creation date are the same,
indicating that the file has not been modified. The Last Access Date/Time shows that
Pileum opened the image to take this screenshot on June 9, 2017.
Pileum then examined Ms. Stewarts iPhone and iCloud account searching for this image or
alterations of the image to attempt to forensically capture the original image and preserve its
metadata for analysis. Mobilsync was able to recover 15 different variations of the image
from Ms. Stewarts iPhone. The metadata of these images place the creation dates from
August 11, 2016 up to June 7, 2017. The images on the following pages are an extraction
of all images found on Ms. Stewarts iPhone matching the image provided by Plaintiff on
May 31, 2017 using the forensics tool Mobilsync, which also extracts and preserves all
metadata from images stored directly on the phone. The metadata is listed to the side of
these photos and includes the Created Date and Modified Date. To retain all historical
data the names of these images will maintain the original names assigned from the iPhone.
Page 9 of 26
5005.JPG.full_image_2955_2956
Size: 49.5 KB
Created: 2017-06-07 21:51:20 +0000
Modified: 2017-06-07 21:51:20 +0000
Orientation: Normal (0 deg)
Path: /mobile/Media/PhotoData/Thumbnails/V2/DCIM/103APPLE/IMG_3791.P
NG
Page 10 of 26
Size: 43.1 KB
Created: 2017-06-07 21:51:20 +0000
Modified: 2017-06-07 21:51:20 +0000
Path: /mobile/Media/PhotoData/Thumbnails/V2/DCIM/103APPLE/IMG_3792.JP
G
Page 11 of 26
Size: 43.1 KB
Created: 2017-06-07 21:51:20 +0000
Modified: 2017-06-07 21:51:20 +0000
Path: /mobile/Media/PhotoData/Thumbnails/V2/PhotoStreamsData/446648212/10
3APPLE/IMG_3345.JPG
Page 12 of 26
Size: 35.8 KB
Created: 2017-06-07 21:50:40 +0000
Modified: 2017-06-07 21:50:40 +0000
Path: /mobile/Media/PhotoData/Thumbnails/V2/DCIM/102APPLE/IMG_2619.JP
G
Page 13 of 26
Size: 43.1 KB
Created: 2017-06-07 21:50:40 +0000
Modified: 2017-06-07 21:50:40 +0000
2APPLE/IMG_2312.JPG
Page 14 of 26
Size: 48.7 KB
Created: 2017-06-07 21:50:37 +0000
Modified: 2017-06-07 21:50:37 +0000
0APPLE/IMG_0112.JPG
Page 15 of 26
IMG_3345.JPG.2441_32000_125_125_516
Size: 1.3 MB
Created: 2017-05-30 23:30:21 +0000
Modified: 2017-05-31 19:41:58 +0000
Resolution: 1242 x 2208
Path: /mobile/Media/PhotoStreamsData/446648212/103APPLE
IMG_3792.JPG.2441_32000_125_125_517
Size: 1.3 MB
Created: 2017-05-30 23:30:21 +0000
Modified: 2017-05-30 23:30:21 +0000
Path: /mobile/Media/DCIM/103APPLE
Page 16 of 26
IMG_3792.JPG.full_image_2018_2249
Size: 1.3 MB
Created: 2017-05-30 23:30:21 +0000
Modified: 2017-05-30 23:30:21 +0000
Page 17 of 26
Size: 1.3 MB
Created: 2017-05-30 23:30:21 +0000
Modified: 2017-05-30 23:30:21 +0000
Path: /mobile/Library/SMS/Attachments/34/04/FB4483A1-3146-4B46-AB87-49425
AA801FF
Page 18 of 26
Size: 1.3 MB
Created: 2017-05-30 23:30:21 +0000
Modified: 2017-05-31 19:41:58 +0000
IMG_3791.PNG.2441_32000_125_125_515
Size: 2.7 MB
Created: 2017-05-30 23:20:56 +0000
Modified: 2017-05-30 23:20:56 +0000
Page 19 of 26
IMG_3791.PNG.full_image_2018_2248
Size: 2.7 MB
Created: 2017-05-30 23:20:56 +0000
Modified: 2017-05-30 23:20:56 +0000
IMG_0112.JPG.2441_32000_125_125_7
Size: 304.6 KB
Created: 2016-08-11 16:46:02 +0000
Modified: 2016-08-22 00:21:13 +0000
Page 20 of 26
Size: 304.6 KB
Created: 2016-08-11 16:46:02 +0000
Modified: 2016-08-22 00:21:13 +0000
Page 21 of 26
When examining Ms. Stewarts iCloud account Pileum discovered that Ms. Stewart had
721 total photos stored in the cloud from May 13, 2015-August 17, 2016. The only
photo in the iCloud account from 2015 was a video unrelated to communications
between Ms. Stewart and Mr. Durham. That photo will be edited to prevent viewing it.
The images below are screenshots from Ms. Stewarts iCloud account showing the total
number of photos as well as the ranging dates.
Image 4: Screenshot of Ms. Stewarts iCloud account containing date ranges and total
photos.
Image 5: Screenshot of Ms. Stewarts 2015 iCloud photos
Page 22 of 26
Pileum discovered the image provided by Plaintiff on May 31, 2017 stored in Ms. Stewarts
iCloud twice. One image which contains the exact same date and time as the creation date
from the metadata discovered from the photo found on Ms. Stewarts iPhone. The second
photo found on Ms. Stewarts iCloud account also has the same date as the second oldest
photo found on Ms. Stewarts iPhone. Both are dated August 11, 2016. The images below
are snapshots of Ms. Stewarts iCloud images that were discovered by Pileum.
Image 6: First Image found in Ms. Stewarts iCloud - matches photo from iPhone.
Page 23 of 26
Image 7: Second image found in Ms. Stewarts iCloud which is same as photo provided by
Plaintiff as found on iCloud with date which matches photo from iPhone
Page 24 of 26
Conclusion
In conclusion, Pileum was unable to discover any communications between Erica Stewart
and Tarold Durham on Ms. Stewarts iPhone or Ms. Stewarts iCloud. Pileum was able to
estimate the activation of the iPhone brought in for examination to August 20, 2016 by
using Apples website and warranty check tool. The image provided by Plaintiff on May 31,
2017 appears on both iCloud and the iPhone multiple times, with multiple modification
dates, with dates in iCloud and the creation date from the iPhones image metadata going
back as late as August 11, 2016.
Page 25 of 26
Appendix A Chain of Custody Form
Page 26 of 26

Belhaven Pileum Report - Redacted

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Belhaven Pileum Report - Redacted

Hochgeladen von

Copyright:

Verfügbare Formate

PILEUM Corporation

Investigative Project Report

Software Version 10.2

Capacity 12 GB Used (1 GB Free)

Examination of Image Provided by Plaintiff on May 31, 2017

Image 5: Screenshot of Ms. Stewarts 2015 iCloud photos

Das könnte Ihnen auch gefallen