‘inal Court Clerk “Twentieth Judicial District, 408 2rd Avenue North i Sulte 2120 coke P.O. Bax 196322 Nashwile, TN 37219-6322 WIGFEB 22 PHI2: 21 SEARCH WARRANT RECEIPT. This will acknowledge receipt by the Criminal Court Clerk’s Office for Davidson County of a Search Warrant in the case of State of Tennessee vs: Mega ees ne Rob Firoegt Silver dlople rome bs Plus, From:___ Josh Sa Lee 7 Clerk's Login No. __ 30.0 This ax dayof__[e loevarg a Davidson County Criminal Court Clerk Deputy ClerkSEARCH WARRANT STATE OF TENNESSEE DAVIDSON COUNTY To the Sheriff, or Any Lawful Officer of Said County Proof by affidavit having been made before me by Special Agent Joshua Saviey, with the Tennessee Bureau of Investigation, that there is probable cause to believe that certain evidence of a crime, to wit: violations of Tennessee state aw as set forth in Tennessee Code Annotated §39-14-103 (Theft of Property) and §39-16-402 (Official Misconduct) and will be found in the cellular telephone owned by the Metropolitan Nashville Police Department previously used by Rob Forrest assigned to telephone number 4 and bearing the identifying IMEI and that the evidence to be searched for is 2s follows: Any and all electronic data to include, recordings, images, emails, SMS messages, MMS messages, instant messages, chats, iMessages, call logs, contact lists, audio recordings, video recordings, photographs, and GPS. ‘or geolocation information. YOU ARE HEREBY COMMANDED to make an immediate search ofthe following electronic device: Silver Apple iPhone 6s Plus - Model A1687 — IMEI which will be found in the custody of the Tennessee Bureau of Investigation. This search warrant will include the transport of this device to electronic evidence recovery specialists within the Tennessee Bureau of Investigation Technical Services Unit or other persons trained in the accessing and imaging of the aforementioned device. You are commanded to search for the aforesaid evidence and if you find the same or any part thereof, you shall seze the evidence and make a lawful return to me and safe keep such evidence until further orders of this court. swans JE yo Eabs se) 216, 122 sever Lm Issued to: Special Agent Joshua Savley, Tennessee Bureau of Investigation Witness my hand, this /6 _ day ot Bebe) Signed: ‘Criminal Court Judge for Davidson Géynty, Tennessee‘Special AFFIDAVIT STATE OF TENNESSEE DAVIDSON COUNTY Personally appeared before me, De AK. Dexeer-criminal Court Judge for Davidson County, Tennessee ‘Agent Joshua P. Saviey, with the Tennessee Bureau of Investigation, who has made oath and has probable cause to believe that certain evidence of a rime, to wit violations of Tennessee state law as set forth in Tennessee Code Annotated §39-14-103 (Theft of Property) and §39-16-402 (Official Misconduct) and wil be found inthe cellular telephone owned ‘number follows: by the Metropolitan Nastwille Police Department reviously used by Sgt Rob Forrest assigned to telephone and bearing the identifying IMEI and that the evidence to be searched for is as Any and all electronic data to include, recordings, images, emails, SMS messages, MMS messages, instant messages, chats, iMessages, call logs, contact lists, audio recordings, video recordings, photographs, and GPS ‘oF geolocation information Statement of Facts and Circumstances In Support of Probable Cause This affidavit is made by Special Agent Joshua Saviey, with the Tennessee Bureau of Investigation. This affidavit is based upon information your Affiant has received from other law enforcement officers, information your Affiant has received from citizens, 1 , and through investigation that your Affiant hes personally conducted, Probable cause is as follows: On February 1, 2018 District Attomey General Glenn R. Funk requested that the Tennessee Bureau of Investigation conduct an investigation into whether the affair between Nashville Mayor Megan Barry and Metropolitan Nashville Police Department (MNPD) Sergeant Rob Forrest led to any misappropriation of funds or official misconduct by either. On this same date your affiant was assigned as the lead investigator in this case. On January 31, 2018 Megan Barry held a press conference where she admitted to having an affair with Sgt. Rob Forrest of the MNPD. Unti that day, he had been the head of her security detail. Rob Forrest submitted his resignation to MNPD on January 17, 2018 and itwas effective January 31, 2018. On February 1, 2018 your affiant spoke with MNPD Deputy Chief Todd Henry concerning the iPhone and iPad of Rob Forrest. It explained that the TBI would like these devices so that the TBI could search them. Henry stated that this was not a problem and arranged contact with Lieutenant Doug Bell who had physical custody of the devices, On February 2, 2018 your affiant met with MNPD Lieutenant Doug Bell to take possession of the iPhone and iPad that had previously been assigned to Rob Forrest. Your affiant submitted both the iPhone and iPad to the TBI ‘Technical Services Unit for analysis. These devices were examined and extraction reports were completed on February 5, 2018. As part of this extraction, it was determined that a unique identifying number assigned to this, iPhone known as an IMEI is 2. It was also determined that this particular phone is an Apple iPhone 6sPlus - Model A1687. Certain items of evidence were recovered including some items that had been deleted from the phone. There is also evidence showing that items were deleted but not recovered in this, extraction. Of note in this extraction are 260 deleted iMessages between the number listed as Megan Barry's phone, \, and Rob Forrest's phone. During the extraction, many of these messages were recovered as a log form only and no content was recovered. Much of the information simply shows that a message was sent of received but the content of that message was not recovered, On February 7, 2018 your affiant met with Executive Administrator for Fiscal Affairs of MNPD, Samir Mehic, In this meeting Mr. Mehic explained that while Rob Forrest served as the head of the Mayor's security going back two previous administrations, he did not have any travel ciaims for his time with either Mayor Karl Dean or Mayor Bill Purcell On February 6, 2018 your affiant received documents produced by Megan Barrys office from her attorney, Jerry Martin. Additional documents were received on February 8 and February 12, 2018. Megan Barry's calendar from January 1, 2017 to January 26, 2018 wes provided as a part of these documents. A list of all trips that Megan Barry took during this timeframe was also provided. Of note are two trips reflected in both her oalendar and travel schedule. They are a trip to Washington DC May 18-17, 2017 and a second trip to Washington DC October 48-19, 2017. Both trips list Megan Barry and Rob Forrest as the only parties travelling on these trips. On February 7, 208 your affiant received payroll records for Rob Forrest from Christy Sawyers of MINPD. Mrs. Sawyers is the Assistant Director for Human Resources for MNPD. In these records are timecards for Rob Forrest dating back to July 10, 2006. These time cards show that Rob Forrest reported working a regular shift from 07:00 to 15:30 and overtime from 16:30 to 21:30 on May 1, 2017. They also show that Rob Forrest reported working a regular shift from 07:00 to 15:30 and overtime from 15:30 to 23:00 on October 18, 2017.10. " 12 8. 14, 18. 16. On February 13, 2017 your affiant met with Don Aaron of MNPD to receive previously requested records. Some of these records were Rob Forests emails from his work email address. That email address is rob forrest@nashville.gov. In a review of these records there are two emails to specifically note, These two ‘emails were sent from his MNPD email address to his MNPD email address. One of the emaiis mentioned in the previous paragraph was sent on May 16, 2017. This email does not have a Subject. This email has a single jpg attachment. This image is of a nude female lying on a bed with a black purse beside her. In the properties ofthis image it is noted that the photograph was taken on May 15, 2017 at 16:29:20. This photo was taken with an iPhone 6s Plus. The name of this image file is IMG_1183. The second email mentioned in the previous paragraph was sent on October 18, 2017. This email does not have a subject This email has a single jpg attachment. This image is of a woman's vagina exposed through black pantyhose with what appears to be a black dress or skirt pulled up above the waist of the woman. In the properties of this image it is noted that the photograph was taken on October 18, 2017 at 15:39:54. This photo was taken with an iPhone 6s Plus. The name of this image file is IMG_2013. On February 15, 2018 your affiant reviewed the iPhone extraction of the aforementioned phone. Your affiant discovered that the closest numbered photograph in sequence to IMG_1183 is a photograph of Megan Barry conducting a radio interview. The name of that fle is IMG_1185. Beside her in this photo is what your afiant believes to be the same black purse seen in IMG_1183. In the properties of image ING_1185 itis noted that the photograph was taken on May 16, 2017 at 08:22711. This photo was teken with an iPhone 6s Plus. Of note is, {hat this photo was taken the morning after the photo of the woman on the bed with the purse beside her. In your affiant’s experience, cameras typically name photos in a numerical sequential order which would indicate that IMG_1185 was the second photo taken after IMG_1183. No IMG_1184 was found on the phone. On February 15, 2018 in the review of the extraction of the aforementioned phone your affiant also discovered that the closest numbered photograph to IMG_2013 is a photograph of Megan Barry in what appears to be a television studio set. The name of that file is IMG_2001. She is wearing a black outfit in this photo. In the properties of image IMG_2001 it is noted that the photograph was taken on October 18, 2017 at 11:13:51. This photo was taken with an iPhone 6s Plus. Of note is that this photo was taken a litle over 4 hours before the photo of the woman's vagina was taken. There were no images numbered IMG_2002 through IMG_2012 found ‘on the phone. In further review of the extraction of Sgt Forrest's phone, your affiant noted many deleted items recovered in the extraction either in part or in whole. There were 35 deleted call logs between Rob Forrest and Megan Barry There were 260 deleted chats between Rob Forrest and Megan Barry. There were 2 deleted SMS messages between Rob Forrest and Megan Barry. In a review of records provided by the Mayor's office, Megan Bary's travel schedule shows that she did not travel with security personnel for the 4 business trips taken during the frst 6 months of her administration. Starting in April 2016, Megan Barry began travelling with security on most out of town business trips. From April 3, 2016 to January 17, 2018 Megan Barry took 45 out of town trips. 10 of these trips were personal trips where she did not have security personnel, Of the 35 business trips during this timeframe, she had security personnel with her for 30 of these trips. Rob Forrest was present on 26 of these trips. Ten of these trips show that Megan Barry and Rob Forrest are the only travelers on the trip. Your affiant would note that there is a marked increase in trips with security around the same time that the affair began in the Spring of 2016. (On February 5, 2018 your affiant reviewed a Summary of Eamings for fiscal years 2013 to 2017 for Rob Forrest land Detective Mike Dixon, both of which were on the Mayor's security detail throughout this timeframe. In the three fiscal years prior to Megan Barry's administration, Rob Forrest reported an average of 650 hours of overtime ‘and Det. Dixon reported an average of 406 hours of overtime. In the two years after Megan Barry took office, Rob Forrest has reported an average of 1189 hours of overtime while Det. Dixon has reported an average of 606 hours of overtime, Rob Forrest's overtime has increased by €3% while Det. Dixon's overtime has only increased by 49%, Based on your affiant’s knowledge, training, and experience, | know that many people use their cell phones to communicate with others in a variety of ways to include but not limited to email, tex, instant messaging, phone calls, and various messaging applications. Many people also document certain events with photographs, video recording or audio recording. Your affiant also knows that many people use location services on their phones and that many phones store this information in the properties of various data fle. Your affiant believes that a more thorough search of Rob Forrest's phone could recover more deleted material from the phone which could prove to be crucial evidence in this case. The device will be sent to a third party contractor to provide advanced technical services. These technical services may include passcode bypass, passcode unlocking, and advanced extractions of the device data. The third party contractor does not provide any type of analysis or examination of the data. The unlocked device and all extracted data will be returned to the Tennessee Bureau of Investigation for technical analysis and examination by the TBI Technical Services Unit,Experience and Basis of Knowledge of Affiant Your affiant is a 2001 Graduate of the University of Tennessee at Knoxville and a 2011 Graduate of the Tennessee Law Enforcement Training Academy. Your afiant has been employed as a Special Agent with the Tennessee Bureau of Investigation MID-CiD since January 2011. Your affiant has completed the following training courses: Criminal Investigations, Financial Investigations, Interview and. Interrogation, Statement Analysis, Death and Homicide Investigations, Child Sex Abuse, Stolen Vehicle Identification, Shooting Scene Reconstruction, Bioodstain Pattern ‘Analysis, Latent Fingerprints, Bomb and Arson investigations, and Crime Scene Management. Your afffant has writen and been involved in the successful execution of search warrants in different counties within this state. Your affiant has also investigated different types of cases to include: property crimes, violent crimes, public corruption, sex crimes, and white-collar crimes. | have acted on and received the information set forth in this affidavit in my capacity 28 2 Special ‘Agent for the Tennessee Bureau of Investigation. CONCLUSION Your affiant believes that probable cause enists to show that Rob Forrest used a department issued iPhone 6 Plus while con duty._ It will also show that on May 15, 2017 and on October 18, 2017 he used this phone to photograph a nude or partially nude female. It will also show that Rob Forrest's timecards report that he was working while these photographs were taken. Your alfiant believes probable cause exists to show that Rob Forrest was indeed not working at the time IMG_1183 and IMG_2013 were taken but was rather participating in the affair wth Megan Barty at these times. Based upon the probable cause set forth in this affidavit, your Affiant prays for @ search warrant to be issued for the recovery of evidence mentioned in this search warrant and supporting affidavit. winegemyanaiie AG aay Exbrase) Affignt 4 ‘Sworn to and subscribed before me tis 76"** day of Pebranny 2018, Signed: 018, Criminal Court Judge for Davidson —OFFICER'S RETURN 3 ‘This within warrant came to hand and was executed on the _LG™Myay of _“Fx bow ssf , 2018, by taking the following described property Het _ _ , - = Lt-J Ses jent Joshua P. Saviey, Tennessee Bureau of Investigation JUDGMENT ON WARRANT STATE OF TENNESSEE DAVIDSON COUNTY Due and proper return having been made of the within warrant, the property seized as described in the said return shell bbe retained, subject to the order of the Criminal Court Clerk of Davidson County, and the within warrant, affidavit, and return shall be filed in the office of the Clerk of said court. This the 222L soy Babess 2018, Signed: Griminal Court Judge for Davidsop’ Gounly, Tennessee