• Menu o Overview o Device Details • NYC024371.dmg (Evidence ID: NYC024371.dmg - 001) o Case Data • Calendar Items • Calls • Contacts • Messages • Top Contacts • User Accounts Case Data: Calls (401-500 of 936) Service Direction Type Date [1] iPhone [2] iPhone [1] iPhone [2] iPhone [2] iPhone [1] iPhone [2] iPhone [1] iPhone [2] iPhone [1] iPhone [2] iPhone [1] iPhone [2] iPhone [1] iPhone [1] iPhone [2] iPhone , 2015-09-14 Incoming r nHone 11:56:50 (UTC) , 2015-09-14 Incoming r nHone 11:56:50 (UTC) Incoming Phone 2015-09-15 (UTC) Incoming Phone 2015-09-15 (UTC) Phone 2015-09-15 Incoming 09:54:08 (UTC) Phone 2015-09-15 Incoming 09:54:08 (UTC) Incoming Phone 2015-09-15 (UTC) Incoming Phone 2015-09-15 (UTC) Phone 2015-09-15 Incoming 12:09:40 (UTC) Phone 2015-09-15 Incoming 12:09:40 (UTC) Incoming Phone 2015-09-15 (UTC) Incoming Phone 2015-09-15 (UTC) , 2015-09-16 Incoming r nHone 08:30:15 (UTC) , 2015-09-16 Incoming r nHone 08:30:15 (UTC) Incoming Phone 2015-09-16 (UTC) Incoming Phone 2015-09-16 (UTC) Contacts <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) Unknown Unknown Duration (HH:MM:SS) 00:00:00 00:00:00 00:00:29 00:00:29 00:01:31 00:01:31 00:00:05 00:00:05 00:00:00 00:00:00 00:00:00 00:00:00 00:00:10 00:00:10 00:00:00 00:00:00 Status EFTA01217433 [2] iPhone Incoming Phone 2015-09-16 11:46:03 (UTC) [1] iPhone Incoming Phone 11:46:03 2015-09-16 (UTC) [2] iPhone Incoming Phone 19:10:18 ( 2015-09-21 (UTC) 2015-09-21 [1] iPhone Incoming Phone 19:10:18 (UTC) [2] iPhone Incoming Phone 2 -23 21:49:10 (UTC) iPhone Incoming Phone 2015-09-23 21:49:10 (UTC) [2] Incoming Phone 2015-09-27 15:01:10 (UTC) [ 1] Incoming Phone 2015-09-27 15:01:10 (UTC) [2] FaceTime Outgoing Video 2015-10-19 11:39:21 (UTC) [1] FaceTime Outgoing Video 2015-10-19 11:39:21 (UTC) [1] FaceTime Outgoing Video 2015-10-23 16:19:20 (UTC) [2] FaceTime Outgoing Video 2015-10-23 16:19:20 (UTC) [2] FaceTime Incoming Video 2015-10-23 18:02:45 (UTC) [1] FaceTime Incoming Video 2015-10-23 18:02:45 (UTC) [1] FaceTime Outgoing Video 2015-11-04 14:14:30 (UTC) [2] FaceTime Outgoing Video 2015-11-04 14:14:30 (UTC) [2] FaceTime Outgoing Video 22:46:4 2016-01-13 6 (UTC) 2016-01-13 FaceTime Outgoing Video 22:46:46 ont) 2016-04-25 [2] FaceTime Outgoing Video 15:33:57 ont) 2016-04-25 FaceTime Outgoing Video 15:33:57 ant) 2016-04-25 FaceTime Outgoing Video 15:35:13 (UTC) 2016-04-25 [2] FaceTime Outgoing Video 15:35:13 (UTC) FaceTime Incoming Video 2016-05-03 21:20:20 (UTC) [2] FaceTime Incoming Video 2016-05-03 21:20:20 (UTC) [ 1] [ 1] [I] [I] [I] iPhone iPhone <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) Unknown ( Unknown ) Unknown ( Unknown ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:03:08 00:03:08 00:16:51 00:16:51 00:00:37 00:00:37 00:02:17 00:02:17 00:02:28 00:02:28 00:01:05 00:01:05 00:00:13 00:00:13 00:00:00 00:00:00 Missed Missed Missed Missed Missed Missed Missed Missed EFTA01217434 iPhone iPhone iPhone iPhone iPhone iPhone iPhone iPhone iPhone iPhone Incoming Phone 2016-05-04 (UTC) Incoming Phone 2016-05-04 (UTC) Incoming Phone 2016-05-04 (UTC) Incoming Phone 2016-05-04 (UTC) Incoming Phone 2016-05-04 (UTC) Incoming Phone 2016-05-04 (UTC) Incoming Phone 2016-05-04 (UTC) Incoming Phone 2016-05-04 (UTC) Incoming Phone 2016-05-04 (UTC) Incoming Phone 2016-05-04 (UTC) 2016-05-14 FaceTime Incoming Video 15:52:47 (UTC) 2016-05-14 FaceTime Incoming Video 15:52:47 (UTC) 2016-05-14 FaceTime Incoming Video 15:52:47 (UTC) 2016-05-14 FaceTime Incoming Video 15:53:20 (UTC) 2016-05-21 FaceTime Incoming Video 15:20:34 (UTC) 2016-05-21 FaceTime Incoming Video 15:20:34 (UTC) Incoming Phone 2016-05-24 (UTC) Incoming Phone 2016-05-24 (UTC) iPhone [2] iPhone [1] iPhone Incoming Phone 2016-05-24 21:00:29 (UTC) [2] iPhone Incoming Phone 2016-05-24 21:00:29 (UTC) 2016-05-25 FaceTime Incoming Video 09:59:27 (UTC) 2016-05-25 [2] FaceTime Incoming Video 09:59:27 (UTC) [1] iPhone Incoming Phone 2 -25 11:44:14 (UTC) [2] iPhone Incoming Phone 2016-05-25 11:44:14 (UTC) [I] <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) Unknown Unknown Unknown Unknown <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:36 00:00:36 00:00:00 00:00:00 Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed EFTA01217435 [ 1] iPhone [2] iPhone [1] iPhone [2] iPhone [2] iPhone [1] iPhone [2] iPhone [1] iPhone [2] iPhone [1] iPhone [2] iPhone [1] iPhone [1] iPhone Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) Incoming Phone 2016-05-25 (UTC) [2] iPhone Incoming Phone 17:46:20 2016-05-25 (UTC) [2] FaceTime Incoming Video 20:03:11 2016-05-29 (UTC) FaceTime Incoming Video 20:03:11 2016-05-29 (UTC) iPhone Incoming Phone 22:02:13 2016-06-01 (UTC) [2] iPhone Incoming Phone 22:02:13 2016-06-01 (UTC) [I] [I] [I] iPhone [2] iPhone [1] iPhone [2] iPhone [1] iPhone [2] iPhone Incoming Phone 2016-06-01 (UTC) Incoming Phone 2016-06-01 (UTC) Incoming Phone 2016-06-02 (UTC) Incoming Phone 2016-06-02 (UTC) Incoming Phone 2016-06-02 (UTC) Incoming Phone 2016-06-02 (UTC) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <EncrY pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00:00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed Missed EFTA01217436 [2] [1] iPhone iPhone [2] iPhone [1] [2] [1] [1] [2] [2] [3] [1] [3] [2] [1] iPhone Incoming Phone 2016-06-02 11:22:49 (UTC) Phone 2016-06-02 Incoming 11:22:49 (UTC) Incoming Phone 2016-06-02 11:27:27 (UTC) Incoming Phone 2016-06-02 11:27:27 (UTC) FaceTime Incoming Audio 2016-06-02 18:07:42 (UTC) FaceTime Incoming Audio 2016-06-02 18:07:42 (UTC) FaceTime Incoming Video 21:09:5 2016-06-08 3 (UTC) FaceTime Incoming Video 21:09:5 2016-06-08 3 (UTC) FaceTime Incoming Video 21:10:0 2016-06-08 0 (UTC) FaceTime Incoming Video 21:10:1 2016-06-08 2 (UTC) FaceTime Incoming Video 21:10:1 2016-06-08 2 (UTC) FaceTime Incoming Video 21:10:1 2016-06-08 2 (UTC) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) Unknown Unknown Unknown Unknown <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) <Encrypted Blob> ( <Encry pted Blob> ) 00:01:33 00:01:33 00:07:57 00:07:57 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 Notes [1] Source Device NYCO24371.dmg/Macintosh HD [1] Source File /Users/Jeffrey/Library/Application Support/CallHistoryDB/CallHistory.storedata [2] Source Device /Macintosh HD [2] Source File /Users/Jeffrey/Library/Application Support/CallHistoryDB/CallHistory.storedata [3] Recovered Record Case Data: Calls (301-400 of 936)Case Data: Calls (501-600 of 936) Missed Missed Missed Missed Missed Missed Missed Missed EFTA01217437