Pandemic Darlings The pandemic economy, in original documents
Home Court filings USA v. Ayvazyan et al United States v. Artur Ayvazyan et al. — C.D. Cal., No. 2:20-cr-00579-SVW Exhibit C — USA v. Ayvazyan et al. (Dkt. 439-4, C.D. Cal.)

Court filing

Exhibit C — USA v. Ayvazyan et al. (Dkt. 439-4, C.D. Cal.)

Summary

Exhibit C, filed 06/07/21 as Document 439-4 in Case 2:20-cr-00579-SVW (C.D. Cal.), is a set of Federal Bureau of Investigation notes by Computer Analysis Response Team examiner Andrew Jaung of the Los Angeles Division, in a file titled IULIA ZHADKO and labeled PPP LOAN FRAUD. The notes log four phones and two SIM cards received on 01/14/2021 under a search and seizure warrant signed 11/03/2020 and the extractions run on them with Cellebrite and GrayKey tools.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Filed June 7, 2021 in USA v. Ayvazyan et al.; one of 698 filings from this case.

Record facts

CourtU.S. District Court for the Central District of California
Filed2021-06-07

Cite this document

“Exhibit C — USA v. Ayvazyan et al. (Dkt. 439-4, C.D. Cal.).” U.S. District Court for the Central District of California, No. 2:20-cr-00579-SVW, Doc. 439-4, filed 2021-06-07. Archived at Pandemic Darlings, https://pandemicdarlings.com/court-filings/full-docket-artur-ayvazyan-cacd-802533/2021-06-07-gov-uscourts-cacd-802533-439-4-doc-439-4/, SHA-256 90c434096973f66655e339a4321d55dfc2ebafe2bb027f5dde0b4ccd4f9687b8.

Search CourtListener for this docket number

Full text

Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 1 of 11   Page ID
EXHIBIT C
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 2 of 11   Page ID
FEDERAL BUREAU OF INVESTIGATION CART NOTES
COMPUTER ANALYSIS RESPONSE TEAM Examiner: ITS-FE Andrew Jaung
LOS ANGELES DIVISION UCFN: 290-LA-3280255

11000 Wilshire Blvd., Los Angeles, CA 90024 Submission ID: 238391

THIS DOCUMENT AND ITS CONTENTS ARE THE PROPERTY OF THE FEDERAL BUREAU OF INVESTIGATION.
DISTRIBUTION OF THIS DOCUMENT OR ITS CONTENTS IS STRICTLY PROHIBITED.

Phone:

Case Agent: | Special Agent (SA) Justin Palmerton
Date Assigned: | 1/08/2021

Legal Authority: Serial #64 Title/Sub:

IULIA ZHADKO; TS PS
Vg Su: PPP LOAN FRAUD

Received evidence items directly from Evidence Control Center (ECC) on 01/14/2021
at 15:45

Item # | QLA# Description

1B6 QLA1 AJ | Motorola Model XT1921-3, IME!: a 1206
1B8 QLA2_AJ | Alcatel 4044T Go Flip

1B12 QLA3_AJ | Verizon SIM card #: a 3997

1B14 QLA4_AJ | Verizon SIM card #: x 4894

1B17 QLAS_AJ | iPhone 11
1B18 QLA6_AJ | iPhone 7, Model A1660

1/14/2021 | AJ

Legal authority for all evidence items, signed on 11/03/2020 in the form of a Search
1/14/2021 | AJ | and Seizure Warrant, was reviewed and valid. Duration of review will be 120 days or
on 03/03/2021.

Powered up 1333 and 3017 workstations, Windows 10, 64-bit, passed
POST without error. Will use these workstations for work documented below unless
specifically noted otherwise.

1/19/2021 | AJ
Created a forensically prepared storage area on the LA-FO3 SAN: \\LA-
FO3\CasesO5\AJ_290-LA-3280255 238391

[INSPECTION]

Inspected QLA1_AJ_1B6, a Motorola Model XT1921-3, IME|: a 1206.
QLA1_AJ_1B6 was clean with no distinctive markings. Power was not on. Back cover
QLA1_AJ_1B6 | 1/27/2021 | AJ | was removed from QLA1 AJ 1B6 to expose the internal components. Device was
not powered on.

[PHOTOS]

Page 1 of 10

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163721

EXHIBIT C
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 3 of 11   Page ID
This document and its contents are the property of the Federal Bureau of Investigation.

FEDERAL BUREAU OF INVESTIGATION
COMPUTER ANALYSIS RESPONSE TEAM
LOS ANGELES DIVISION

11000 Wilshire Blvd., Los Angeles, CA 90024 Submission ID: 238391

CART NOTES
Examiner: ITS-FE Andrew Jaung

UCFN: 290-LA-3280255

Distribution of this document or its contents is STRICTLY prohibited.

[IMAGE PROCESS]
Utilized Cellebrite Premium to conduct an Advanced Logical, File System, and

Physical extraction

QLA1_AJ_1B6

2/1/2021

AJ

Utilized Cellebrite Physical Analyzer v7.38.0.51 to process the extraction.

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

Page 2 of 10

DOJ_PROD_0000163722

an
an

EXHIBIT C
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 4 of 11   Page ID
FEDERAL BUREAU OF INVESTIGATION
COMPUTER ANALYSIS RESPONSE TEAM

LOS ANGELES DIVISION

11000 Wilshire Blvd., Los Angeles, CA 90024

This document and its contents are the property of the Federal Bureau of Investigation.
Distribution of this document or its contents is STRICTLY prohibited.

CART NOTES

Page 4o0f11 Page ID

Examiner: ITS-FE Andrew Jaung

UCFN: 290-LA-3280255

Submission ID:

Cellebrite UFED Reader report was generated

@ Generate Report

General

Universal_Android A...

Security

Table Sorting

| UFDR (For Cellebrite R...

Updiste report settings

Report Dataset - Universal_Android Access

Time range filter

O Only events between these dates

From: To:

_J Include items without a timestamp

= Data types
Select/Deselect All

Applications (5459/5489)
Archives (96/96)

Audio (224/224)

Autofill (24/24)

Call Log (1500/1500)
Chats (2/2)
Configurations (164/164)
Contacts (444/444)
Cookies (168/168
& Databases (907/907)
Device Events (10/10)
Device Info (59/59)
Device Users (3/3)

=| Preferences
*) Tags table (0/0)

] Calculate SHA-2 (256 bit) hash
Calculate MDS (128 bit) hash
Include translations

J Include known files
1 Include Malware scanner results
D Include Hash set results
OD Redact all attachments

Q

Documents (9/3)
Emails (316/318)
Images (21447/21447)
Installed Applications (766/765)
Instant Messages (12/12)
Passwords
Text (13652/1
Uncategorized (23994/23994)
@ User Accounts (25/25)
Videos (50/50
Wireless Networks (3/3)

Tags only (0/0)
Include merged items (analyzed data)
Include merged items (data files)
@ Include Cellebrite Reader
Include source info indication
@ Include enrichments / Review
D Hide extraction source indication
Include account package

Previous Next Finish Cancel

QLA2_AJ_1B8

1/20/2021

AJ

[INSPECTION]

Inspected QLA2_AJ_ 1B8, an Alcatel 4044T Go Flip. QLA2_AJ_1B8 was clean with no
distinctive markings. Power was not on. Back cover was removed from QLA2_ AJ 1B8
to expose the internal components. Was unable to image device due to connectivity

issues.

[PHOTOS]

Page 3 of 10

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

DOJ_PROD_0000163723

EXHIBIT C
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 5 of 11   Page ID
FEDERAL BUREAU OF INVESTIGATION
COMPUTER ANALYSIS RESPONSE TEAM Examiner: ITS-FE Andrew Jaung
LOS ANGELES DIVISION
11000 Wilshire Blvd., Los Angeles, CA 90024 Submission ID: 238391

This document and its contents are the property of the Federal Bureau of Investigation.
Distribution of this document or its contents is STRICTLY prohibited.

CART NOTES

UCFN: 290-LA-3280255

QLA3_AJ 1B12 | 1/20/2021

AJ

[INSPECTION]

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163724

EXHIBIT C
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 6 of 11   Page ID
FEDERAL BUREAU OF INVESTIGATION

CART NOTES

COMPUTER ANALYSIS RESPONSE TEAM Examiner: ITS-FE Andrew Jaung

LOS ANGELES DIVISION

UCFN: 290-LA-3280255

11000 Wilshire Blvd., Los Angeles, CA 90024 Submission ID: 238391

This document and its contents are the property of the Federal Bureau of Investigation.
Distribution of this document or its contents is STRICTLY prohibited.

Inspected QLA3_AJ_1B12, a Verizon SIM card #: 399 7.

240-\4 -32$0257

IP 239541
S43 43_ ibe ,
Yale, AS

[IMAGE PROCESS]
Utilized Cellebrite UFED v7.38.0.12 to conduct a SIM extraction

QLA3_AJ_1B12

1/20/2021

AJ

Utilized Cellebrite Physical Analyzer v7.38.0.51 to process the extraction.

EXTRACTION SUMMARY

Extraction completed successfully

ADDITIONAL EXTRACTIONS

Page 5 of 10

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163725
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 7 of 11   Page ID
FEDERAL BUREAU OF INVESTIGATION

CART NOTES
Examiner: ITS-FE Andrew Jaung

COMPUTER ANALYSIS RESPONSE TEAM
LOS ANGELES DIVISION

UCFN: 290-LA-3280255

11000 Wilshire Blvd., Los Angeles, CA 90024

Submission ID: 238391

This document and its contents are the property of the Federal Bureau of Investigation.
Distribution of this document or its contents is STRICTLY prohibited.

Update report vettingn

Cellebrite UFED Reader report was generated
D Sererate Repent - oa x
General Report Dataset - Logical
=) Time range fitter
| Only events between these dates
Logical From: To: 7
Security
(J inetugde nems without a timesamp:
=) Data types
Table Sorting Gi Sclect/Deselect All bal
UFDR (For Cellebrite R. B Device info (3/3) Gsm ob. oo)
Tags nly (0/9)
sh G cat:
n \ *)
Gin
wits &
O Inchude Ha: sults O Hide ext, n sou"
C) Redact all attachments Include account package
Foreth Cancel

[Previews | [Next

SYID235 4)
QLA4 AJ 1B14 1/20/2021

14894 RR

[INSPECTION]
Inspected QLA4 AJ_1B14, a Verizon SIM card #: x 4894.

AJ | QyVA4-AS_ tO

Page 6 of 10

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

DOJ_PROD_0000163726

EXHIBIT C
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 8 of 11   Page ID
FEDERAL BUREAU OF INVESTIGATION

CART NOTES

COMPUTER ANALYSIS RESPONSE TEAM Examiner: ITS-FE Andrew Jaung

LOS ANGELES DIVISION

UCFN: 290-LA-3280255

11000 Wilshire Blvd., Los Angeles, CA 90024 Submission ID: 238391

This document and its contents are the property of the Federal Bureau of Investigation.
Distribution of this document or its contents is STRICTLY prohibited.

[IMAGE PROCESS]
Utilized Cellebrite UFED v7.38.0.12 to conduct an SIM extraction

Utilized Cellebrite Physical Analyzer v7.38.0.51 to process the extraction.

EXTRACTION SUMMARY

Extraction completed successfully

ADDITIONAL EXTRACTIONS

QLA4 AJ 1B14 |} 1/20/2021 AJ
Cellebrite UFED Reader report was generated
BD Geserate Report fs} 4
Seneral Report Dataset - Logical
Time range filter
Datatpes
UFDR (ForCelletrite R. BCevies nto OA} Bsmo pin VO
[INSPECTION]
Inspected QLAS AJ 1B17, an iPhone 11. QLAS AJ 1B17 was clean with no
QLAS AJ 1B17 wae ge ; .
SM1 1/27/2021 | AJ | distinctive markings. Power was not on. Device was locked.
[PHOTOS]
Page 7 of 10
CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163727

EXHIBIT C
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 9 of 11   Page ID
FEDERAL BUREAU OF INVESTIGATION Ee seAeS

COMPUTER ANALYSIS RESPONSE TEAM Examiner: ITS-FE Andrew Jaung
LOS ANGELES DIVISION UCFN: 290-LA-3280255

11000 Wilshire Blvd., Los Angeles, CA 90024 Submission ID: 238391

This document and its contents are the property of the Federal Bureau of Investigation.
Distribution of this document or its contents is STRICTLY prohibited.

[IMAGE PROCESS]

Attempted to conduct a GrayKey, OS Version: 1.6.9, App Bundle: 1.15.8 (GK), full file
system extraction of QLA5, but was unsuccessful. GK was able to obtain a Before
First Unlock (BFU) extraction of the device.

GK was unable to obtain the passcode for the device and does not support brute
force method at this time.

BFU extraction was saved onto SM1, a forensically wiped Samsung 1TB SSD, SN:

EE 24 and copied to the source folder.

Attempted Passcode found on QLA6 AJ 1B18: 1031, on this device. Passcode did
not work.

Utilized Cellebrite Physical Analyzer v7.38.0.51 to process the BFU extraction.

QLAS_AJ_1B17 | 1/27/2021} AJ

QLAS_AJ 1B17 | 1/29/2021 | AJ

Cellebrite UFED Reader report was generated

Page 8 of 10

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163728

EXHIBIT C
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 10 of 11   Page ID
This document and its contents are the property of the Federal Bureau of Investigation.
Distribution of this document or its contents is STRICTLY prohibited.

FEDERAL BUREAU OF INVESTIGATION
COMPUTER ANALYSIS RESPONSE TEAM
LOS ANGELES DIVISION UCFN: 290-LA-3280255
11000 Wilshire Blvd., Los Angeles, CA 90024 Submission ID: 238391

CART NOTES
Examiner: ITS-FE Andrew Jaung

@ Generate Report = oO x
General Report Dataset - Apple iOS Full File system
— Time range filter
C1 Only events between these dates
Apple iOS Full File sy... From: To:
Security
indude items vithaut a timestamp
— Data types
Table Sorting Select/Deselect All

UFOR (For Cellebrite R...

SSEGn
es a

Sas

Tags only (0/0)
G Include merged items (analyzed data)
include rm s (data filles)

LJ Redact all attachments include account package

[INSPECTION]
Inspected QLA6 AJ 1B18, an iPhone 7, Model A1660. QLA6 AJ 1B18 was clean with

no distinctive markings. Power was not on. Device was locked

[PHOTOS]

QLA6_AJ 1B18 | 1/27/2021 | AJ
[IMAGE PROCESS]
CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163729

EXHIBIT C
Case 2:20-cr-00579-SVW     Document 439-4     Filed 06/07/21     Page 11 of 11   Page ID
CART NOTES
Examiner: ITS-FE Andrew Jaung

FEDERAL BUREAU OF INVESTIGATION
COMPUTER ANALYSIS RESPONSE TEAM
LOS ANGELES DIVISION UCFN: 290-LA-3280255
11000 Wilshire Blvd., Los Angeles, CA 90024 Submission ID: 238391

This document and its contents are the property of the Federal Bureau of Investigation.
Distribution of this document or its contents is STRICTLY prohibited.

GK was used to obtain the passcode: 1031. GK full file system was also obtained.

Cellebrite UFED Reader report was generated

B GencrateReport

General Report Dataset - Apple iOS Full File system

Time range filter

_] Only events between these dates
Apple 10S Full File sy. From To:
Security
Include hems without a timestamp
Data types

Table Sorting Select/Deselect All

G Device Events (343/943,

Acwvities

UFDR (For Cellebrite R. .
G Aggregat n Usage (4/4)

QLA6 AJ 1B18 | 1/29/2021 | AJ

Previous Next hreth

Was asked by case agent to create 4 Blu-Ray Discs (BD-R) containing the extractions
of 1B6, 1B12, and 1B14.

4/19/2021 | AJ . . . .
/19/ DEFENSE COPY — Mobile extractions for evidence items 1B6 (Motorola Model:
XT1921-3, IME|: RR 1206), 1812 (Verizon SIM card #:

exDORN and 1B14 (Verizon SIM card _ OS

Page 10 of 10

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163730

EXHIBIT C

File and source

File
gov.uscourts.cacd.802533.439.4.pdf
Size
6,568,886 bytes
SHA-256
90c434096973f66655e339a4321d55dfc2ebafe2bb027f5dde0b4ccd4f9687b8
Our copy
gov.uscourts.cacd.802533.439.4.pdf
Original
PACER (login required)
  1. Exhibit D — USA v. Ayvazyan et al. (Dkt. 439-5, C.D. Cal.)same docket · 2021-06-07
  2. Exhibit B — USA v. Ayvazyan et al. (Dkt. 439-3, C.D. Cal.)same docket · 2021-06-07
  3. Exhibit E — USA v. Ayvazyan et al. (Dkt. 439-6, C.D. Cal.)same docket · 2021-06-07
  4. Exhibit A — USA v. Ayvazyan et al. (Dkt. 439-2, C.D. Cal.)same docket · 2021-06-07
  5. Exhibit F — USA v. Ayvazyan et al. (Dkt. 439-7, C.D. Cal.)same docket · 2021-06-07
  6. Declaration of Ashwin J. Ram in Support — USA v. Ayvazyan et al (Dkt. 439.1)same docket · 2021-06-07
  7. Exhibit G — USA v. Ayvazyan et al. (Dkt. 439-8, C.D. Cal.)same docket · 2021-06-07
  8. Reply in Support of Joint Notice of Motion and Motion to Exclude — USA v. Ayvazyan et al. (Dkt. 439, C.D. Cal.)same docket · 2021-06-07
  9. Exhibit H — USA v. Ayvazyan et al. (Dkt. 439-9, C.D. Cal.)same case · 2021-06-07
  10. Exhibit B — USA v. Ayvazyan et al. (Dkt. 426-4, C.D. Cal.)same case · 2021-06-07
  11. Exhibit A — USA v. Ayvazyan et al. (Dkt. 426-3, C.D. Cal.)same case · 2021-06-07
  12. Declaration of Ashwin J. Ram in Support — USA v. Ayvazyan et al (Dkt. 426.2)same case · 2021-06-07
  13. Proposed Order — USA v. Ayvazyan et al (Dkt. 426.1)same case · 2021-06-07
  14. Notice of Motion and Motion to Strike — USA v. Ayvazyan et al. (Dkt. 426, C.D. Cal.)same case · 2021-06-07
  15. Notice of Motion and Motion in Limine to Preclude — USA v. Ayvazyan et al. (Dkt. 451, C.D. Cal.)same case · 2021-06-08
  16. Proposed Order — USA v. Ayvazyan et al (Dkt. 451.1)same case · 2021-06-08
  17. Declaration of Ashwin J. Ram in Support — USA v. Ayvazyan et al (Dkt. 451.2)same docket · 2021-06-08
  18. Exhibit A — USA v. Ayvazyan et al. (Dkt. 451-3, C.D. Cal.)same docket · 2021-06-08
  19. Exhibit B — USA v. Ayvazyan et al. (Dkt. 419-3, C.D. Cal.)same docket · 2021-06-04
  20. Exhibit B — USA v. Ayvazyan et al. (Dkt. 451-4, C.D. Cal.)same docket · 2021-06-08

Part of: United States v. Artur Ayvazyan et al. — C.D. Cal., No. 2:20-cr-00579-SVW · U.S. District Court for the Central District of California · Paycheck Protection Program (PPP) · COVID Economic Injury Disaster Loans (EIDL) · Criminal prosecutions · Exhibits and declarations · 2021 · Court filings

Back to top