CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE

TABLE OF CONTENTS

1 Executive Summary 3
2 Evidence and Custodians 3
2.1 Evidence 3
2.2 Custodians 4
3 Methodology 4
3.1 Preservation 4
3.2 Analysis 4
4 Findings 5
4.1 Location 5
4.2 Communications with Hickman 5
4.3 Any other findings (optional) 5
5 Conclusion 6

CONFIDENTIAL
CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE

1 EXECUTIVE SUMMARY
For this investigation, a forensic image of an iPhone SE has been analyzed. The

investigation found evidence in the iPhone’s applications, location services, call logs, messaging

database and other services on the phone. The evidence discovered was used to answer questions

about physical activities such as the location of the phone at precise times; messages sent;

messages received and photos exchanged between the device and other devices. It is important to

note that the investigation focused on events and activities that took place on or around

04/05/2020.

2 EVIDENCE AND CUSTODIANS

The evidence examined was from an iPhone SE mobile device. As previously mentioned,

applications such as Maps, Skype and Photos were examined to determine the location of the

device on 04/05/2020. Messages were also examined to determine who the device owner was

communicating with on this day. According to the Cellebrite report, the device was backed-up by

Joshua Hickman. However, the AppleID of this iPhone SE is thisisdfir@gmail.com. The serial

number of the device is: DX3T126VH2XV.

2.1 EVIDENCE

The forensic report was completed on 6/6/2023. The make and model of the device is an

Apple iPhone SE that was last backed-up by Joshua Hickman.

CONFIDENTIAL
CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE

2.2 CUSTODIAN
Judging by the device back-up, it seems like the owner of this device is Joshua Hickman.

The address associated with this device and account is Sweet Vista Ln, 152, Wake, Holly

Springs, 27540, North Carolina, United States. The MSISDN last used with the SIM card is

+19195794674

3 METHODOLOGY
Cellebrite Physical Analyzer version 7.62.0.59 was used to conduct the forensic analysis

of the iPhone image. Magnet Axiom Examine software was also used to conduct the

investigation. While both services produce similar investigation results, it is important to point

out that each service was used for different purposes. Cellebrite was used to extract messages

and Axiom was used to examine phone call logs, locations of the device and cell towers utilized

during phone calls.

3.1 PRESERVATION

The Cellebrite Reader and Axiom softwares were used to preserve the digital evidence.

Without properly preserving the findings with legitimate software, the evidence is inadmissible

in court.

3.2 ANALYSIS

Analysis of the evidence found that the location of the device was in North Carolina. The

investigation mainly focused on evidence that indicated where the device was located on

CONFIDENTIAL
CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE

04/05/2020. Messages, application usage and phone call logs were analyzed and ultimately

used to determine the location of the iPhone SE.

4 FINDINGS

4.1 LOCATION

An address was entered into the Maps application. The address associated with this entry

is Sweet Vista Ln, 152, Wake, Holly Springs, 27540, North Carolina, United States. Another

important finding was in the messages sent from THISISDIFR via the Skype application.

THISISDIFR realized that Snapchat has location sharing capabilities and sent the message on

Snapchat acknowledging that he was aware of the Snapchat feature.

4.2 COMMUNICATIONS WITH HICKMAN

Joshua Hickman is a name that was investigated during this forensic investigation due to

several factors. A picture message was sent from Hickman to THISISDIFR. Hickman is also the

owner of the computer that was used to backup the iPhone SE that was being investigated.

5 CONCLUSION
In conclusion, the findings of this iPhone forensic image suggests that the account

associated with this iPhone SE is closely related to Joshua Hickman as phone-call logs, messages

and device back-ups were connected to Hickman. Evidence found in the location services also

suggest that this device was in North Carolina on 04/05/2020. This was evident by the cell phone

CONFIDENTIAL
CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE

tower that picked up a phone conversation from the device. Additionally, the Maps application

that was opened and used on 04/05/2020 searched an address that was in North Carolina. Lastly,

the location of the parked car was in North Carolina as well. After reviewing the evidence, there

is no indication that the iPhone SE was in any other state besides North Carolina during the time

period in question.

CONFIDENTIAL