Court filing

Exhibit E — USA v. Ayvazyan et al. (Dkt. 439-6, C.D. Cal.)

Summary

Exhibit E to Document 439-6 in Case 2:20-cr-00579-SVW, filed 06/07/21, is 21 pages of forensic examination notes by ITS-FE Gregory J Parra under file 290-LA-3280255, covering the devices in SUID 238390 and 238399. The notes log each device by item number, among them a Samsung Galaxy Tablet, a Vertu Constellation phone and an iPhone X, and record the Cellebrite UFED4PC version 7.38.012 extractions and the UFED reader reports created for the investigator.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Filed June 7, 2021 in USA v. Ayvazyan et al.; one of 698 filings from this case.

Record facts

Court	U.S. District Court for the Central District of California
Filed	2021-06-07

Cite this document

“Exhibit E — USA v. Ayvazyan et al. (Dkt. 439-6, C.D. Cal.).” U.S. District Court for the Central District of California, No. 2:20-cr-00579-SVW, Doc. 439-6, filed 2021-06-07. Archived at Pandemic Darlings, https://pandemicdarlings.com/court-filings/full-docket-artur-ayvazyan-cacd-802533/2021-06-07-gov-uscourts-cacd-802533-439-6-doc-439-6/, SHA-256 0cd56d1d3d7f21f90cbedd7abde4c60026a80bc1880b60f8aca9b8a5e0c4494e.

Search CourtListener for this docket number

Full text

Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 1 of 22   Page ID
EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 2 of 22   Page ID
Notes ;
290-LA-3280255 Gregory J ggegaten sinedty

SUID 238390 & 238399
ITS-FE Gregory J Parra
(Note, SUID 238399 include 1B130, 1B131 & 1B132)

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Date: 2021.05.18 07:51:55
Parra roo

1/11/2021

Samsung Galaxy Tablet model SM-T377V

Connect 1B20 to exam computer 4 124. Connect previously wiped staging drive to exam computer
via USB drive dock. The staging drive will be used to host the extractions. Use UFED4PC version
7.38.012 for the following extraction types:

Opened extraction with Physical Analyzer version 7.38

Create UFED reader report for the investigator.

4 General

Android ID

Detected manufacturer
Detected model
Phone revision

ESN

Advertising ID

Phone date/time

Client Used for Extraction

Time Zone

SSSSSSSEESh

Advertising ID #1

1B94

Vertu Constellation RHV-8 phone including at&t SIM card white and blue in color. Connect phone to
exam computer via Cellebrite cable #124. Use UFED4PC version 7.38.012 for the following extraction

types:
Processed SIM card AT&T

Open extraction in Physical Analyzer version 7.38 ee

Process phone File system

Create UFED reader report for the investigator. The extraction and UFED report was saved to CART
staging media.

Detected manufacturer Nokia
IMEI 2193
Serial |
Product code 0530976
CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163697

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 3 of 22   Page ID
Notes
290-LA-3280255

SUID 238390 & 238399
ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Product basic code
Module code
Hardware number
User code

IMSI

ICCID

ICCID

Bluetooth activity
Bluetooth status
Bluetooth device name
ICCID

IMSI

ACC

1B21

SE ¢936

8901260430019263495 (Previous)

Off
Shown

Vertu Constellation

SE “226

0x0040 = Class 6

iPhone X Model A1901, S/n DNQW1LPFJCLJ, IMEI 35 304309 615074 6, 64GB

Eject SIM, power phone, verify Airplane mode is on, Airplane mode verified on, insert SIM. Connect
1B21 to exam computer [j4124. Use UFED4PC version 7.38.012 for the following extraction types:

File system

Open extraction in Physical Analyzer version 7.38
Create UFED reader report for the investigator.

The extraction and UFED report were saved to CART staging media.

MSISDN +1 (818) 414-5533
IMEI 746
Detected Phone Model IdentifieriPhone10,6
Owner Name iPhone

Is encrypted True

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163698

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 4 of 22   Page ID
Notes
290-LA-3280255

SUID 238390 & 238399
ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)

Page ID

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Serial

ICCID

Unique ID

OS Version

Message Retention Duration
Apple ID

iCloud account present
Last Activation Time
Model number

Last user ICCID

Last used MSISDN
AirDrop ID

Last Cloud Backup Date

DNQW1LPFJCU

Forever
ttammydadyan@ao!.com
True

11/5/2020 7:29:42 PM(UTC+0)

D221AP

S22
SE 150

2020-11-05T08:47:55.000+00:00

Advertising Id (IDFA) #1 E331B91E-D9CE-4C46-9C78-94DF148F6645

Bluetooth device address
Serial

IMSI

IMEI

ICCID

Unique ID

WiFi address

Detected modeliPhone

Phone date/time

Detected Phone Model Identifier

OS Version

Time Zone

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

c8:3c:85:54:d0:03

Pe

a 279

a 67°
eS 02

c8:3c:85:54:d0:02

(D221AP)

11/5/2020 7:58:20 PM(UTC+0)
iPhone10,6

(UTC-08:00) Los_ Angeles (America)

DOJ_PROD_0000163699

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 5 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Locale languageen_US

Phone date/time 11/5/2020 7:58:39 PM(UTC+0)

Sync host name Computer: GBP - CLIMRRHHSH3QF\User: Diagnostics

Sync host name Computer: natalie’s MacBook Air\User: Tammy

Sync host name Computer: tammy’s MacBook Pro\User: tammy

Location Services Enabled False Be
MSISDN S533

Find my iPhone enabled True

Detected Phone Model iPhone X

1B80

iPhone 7 Model A1778, S/n JHG7G, IME! 37449 9 6, 32GB

Eject SIM, power phone, verify Airplane mode is on, Airplane mode verified on, insert SIM. Connect
1B80 to exam computer F5264124. Use UFED4PC version 7.38.012 for the following extraction types:

File system

Logical

Open extraction in Physical Analyzer version 7.38
Create UFED reader report for the investigator.

The extractions and UFED report were saved to CART staging media.

Detected model MN9E2
Phone revision 13.3.1 (17D50)
IMEI a 249°
Serial a 1G7c
ICCD 6045
MSISDN -3026
MSISDN Type MSISDN
CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163700

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 6 of 22   Page ID
Notes
290-LA-3280255

SUID 238390 & 238399
ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)

Page ID

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Bluetooth device address
WiFi address

Unique Device ID
Advertising ID

E-mail
devices.

OS Version

Detected Phone Model IdentifieriPhone9,3

Detected Phone Model iPhone 7 (A1778)

Owner Name

ICCID

IMEI

MSISDN

Serial

Is encrypted

Unique ID

Message Retention Duration
iCloud account present
Last Activation Time
Model number
MSISDN

Last user ICCID

Last used MSISDN
ICCID

Unique ID

Detected modeliPhone

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

c0:d0:12:c9:26:28

c0:d0:12:c9:26:0c

1D88C782-A4DE-4185-ABD5-5E8D3F3BEA62

Email extraction on Apple devices is only available for jail-broken

a Fe Be af

iPhone

a <2°°

GN 1G7c

True

Forever

False

10/31/2020 4:10:48 AM(UTC+0)

D101AP

/EEE300

M3026
E2050

(D101AP)

DOJ_PROD_0000163701

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 7 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Phone date/time 11/5/2020 5:20:28 PM(UTC+0)
Detected Phone Model Identifier iPhone9,3

Detected Phone Model iPhone 7 (A1778)

OS Version sisi

Time Zone (UTC-08:00) Los_ Angeles (America)
Locale languageen _US

Location Services Enabled False

MSISDN 1 3026

1B96

iPhone 6 model A1549, S/n , IME| 35 OfJG6026 3 no SIM card
Power on, Passcode Protected, Need GrayKey, power off.
1/27/2021
Partial file system extraction using GrayKey
Si
GrayKey Progress Report

Evidence ID: 1B96-GP
Examiner Name: FE Greg Parra

6.9, App Bundle 1.15.8

17.36.26 UTC

10.3.3 [T4660]
Phone 6 (iPhone? 2 N61AP}

Unique Chip ID (ECID)
WIFIMAC Address
Bauetooth NAC Acdress
Phone Number

IMEI

Data Pantiton Size 8.6268 (920044909 bylet
Lock State @ First Uniock

Agent Verson 5.8
Bactup State Cloud Backup, Last Backup Date 2017-06-15 07:18:37 UTC
Owner Name jAyvazyan

Accounts

1/28/2021
Open Graykey extraction using Physical Analyzer version 7.38. Create UFED Report for the investigator.

Message Retention Duration Forever

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163702

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 8 of 22   Page ID
Notes
290-LA-3280255

SUID 238390 & 238399
ITS-FE Gregory J Parra

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Apple ID
Apple ID
Apple ID
iCloud account present
Owner Name

Last Activation Time
Model number

Last user ICCID

Last used MSISDN
Serial
IMEI
Unique ID
AirDrop ID

Last Cloud Backup Date

True

iPhone

1/6/2018 7:59:15 AM(UTC+0)

Oo)
Pay
uv

2017-06-15T07:18:37.000+00:00

Advertising Id (IDFA) #1 PO

Location Services Enabled True

VoiceMemo Size (bytes) fe)

VoiceMemo Entries 0

UserData Size (bytes) ‘10664935424

UserData Entries 7934

Storage available (Bytes) '1362444288

Book Size (bytes) 8192

Book Entries 0

Application Size (bytes) ‘4261539840

Application Entries ik

Logs Size (bytes) 15507456

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

DOJ_PROD_0000163703

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 9 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Logs Entries 501

Ringtone Size (bytes) )

Ringtone Entries 0

Proofing Size (bytes) 0

Proofing EntriesO

Storage capacity (Bytes) "12313587712

Wi-Fi MAC address FP

MAC address Po

MAC address Po

Time Zone (UTC-08:00) Los_Angeles (America)

Locale languageen_
ICCID

MSISDN

Find my iPhone enabled

Detected Phone Model iPhone 6

1B79
1/12/2021

iPhone 8 model A1905, S/n 67, IME! i 117 i

Eject SIM, power phone, verify Airplane mode is on, Airplane mode verified on, insert SIM. Connect
1B79 to exam computer J124. Use UFED4PC version 7.38.012 for the following extraction types:

Filesystem
Logical

Open extraction in Physical Analyzer version 7.38.

Create UFED reader report for the investigator.

The extraction and UFED report were saved to CART staging media

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163704

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 10 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Detected model MQ6G2

Phone revision 13.3 (17C54)

IMEI a 1177

Serial a) 1c67

ICCID a 4 7053

MSISDN 6 360

MSISDN Type MSISDN

IMSI a 2103

Bluetooth device address d4:a3:3d:d0:de:87

WiFi address d4:a3:3d:d0:de:86

Unique Device ID Po
Advertising ID 61E64807-CF17-4D74-B797-7A8C3C4E9333
E-mail Email extraction on Apple devices is only available for jail-broken devices.
Serial | ey

Unique ID 86
OS Version 13.3

Owner Name iPhone

ICCID a 7053

Detected Phone Model Identifier iPhone10,4

IMEI a 1.177

Is encrypted True

MSISDN 6 360

Message Retention Duration Forever
iCloud account present False
Last Activation Time 10/29/2020 12:54:31 AM(UTC+0)

Model number D201AP

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163705

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 11 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

ICCID He 6327

Last used MSISDN +1360

MSISDN

Last user ICCID es 7053

AirDrop ID £392

Unique ID a © °0<
Detected modeliPhone (D201AP)

Phone date/time 11/5/2020 4:56:06 PM(UTC+0}
Detected Phone Model Identifier iPhone10,4

OS Version 13.3

Time Zone (UTC-08:00) Los_Angeles (America)
Locale languageen _US

Location Services Enabled False

MSISDN WE 6360

1B130

1/11/2021

iPhone 11 passcode protected

Process with Graykey GrayKey Serial #: 82c21ff2d4991a20 GrayKey Software: OS Version: 1.6.8.1, App
Bundle: 1.15.7.

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163706

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 12 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

GrayKey Progress Report

Evidence ID: 1B130_LA3280255

GrayKey Serial #: 82c21ff2d4991a20
GrayKey Software: OS Version: 1.6.8.1, App Bundle: 1.15.7
Report generation time: 2021-01-11 19:51:26 UTC

Target Device Information

Device Name TAMARAs iPhone

Software Version 14.0 [18A373]

Model iPhone 11 [iPhone12,1 N104AP]
Unique Device ID (UDID) 402E
Serial Number | F4HD5K40N72J

Unique Chip ID (ECID) 662

WiFi MAC Address 64:0b:d7:78:4¢:35

Bluetooth MAC Address 64:0b:d7:7b:2b:29

IMEI 5499

Data Partition Size 24.30GB (26088579072 bytes)

Lock State Before First Unlock

Agent Version 1.15.7

Backup State iCloud Backup, Last Backup Date: 2020-10-30 08:02:41 UTC
Owner Name TAMARA DADYAN

Accounts ttammydadyan@aol.com

Extraction copied to staging drive using TeraCopy version 3.26

1/12/2021

Open extraction in Physical Analyzer version 7.38
Create UFED reader report for case agent review.
1/11/2021

1B131

iPhone 7 Passcode protected

Process with Graykey GrayKey Serial #: 82c21ff2d4991a20 GrayKey Software: OS Version: 1.6.8.1, App

Bundle: 1.15.7.

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

DOJ_PROD_0000163707

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 13 of 22   Page ID
Notes
290-LA-3280255

SUID 238390 & 238399
ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

GrayKey Progress Report

Evidence ID: 1B131_LA3280255

GrayKey Serial #: 82c21ff2d4991a20
GrayKey Software: OS Version: 1.6.8.1, App Bundle: 1.15.7
Report generation time: 2021-01-13 02:55:25 UTC

Target Device Information

Device Name iPhone

Software Version 12.4 [16G77]

Model iPhone 7 (Global) [iPhone9,1 D10AP]

Unique Device ID (UDID) ee 28 7 6c
Serial Number a 6

Unique Chip ID (ECID)

WiFi MAC Address

c4:2a:d0:2c:1b:f7

Bluetooth MAC Address c4:2a:d0:23:9e:92

IMEI N/A

Data Partition Size 1.72GB (1845952512 bytes)
Lock State Before First Unlock

Agent Version 1.15.7

Backup State

iCloud Backup, Last Backup Date: Never

Owner Name

Assiya Yessekenova

Accounts

alcarazanthony30@gmail.cam, babakfarid11@yahoo.com, yessass22@gmail.com

1/26/2021

Open extraction in Physical Analyzer version 7.38.

Create UFED reader report for the investigator.

1/11/2021

1B132

iPhone 7 Passcode protected

Process with Graykey GrayKey Serial #: 82c21ff2d4991a20 GrayKey Software: OS Version: 1.6.8.1, App

Bundle: 1.15.7.

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

DOJ_PROD_0000163708

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 14 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

GrayKey Progress Report
Evidence ID: 1B132_LA3280255

GrayKey Serial # 82c21ff2d4991a20
GrayKey Software: OS Version: 1.6.8.1, App Bundle: 1.15.7
Report generation time: 2021-01-14 23:06:55 UTC

Target Device Information

Device Name iPhone
Software Version 13.2.2 [17B102]
Model iPhone 7 (Global) [iPhone9,1 D10AP]
Unique Device ID (UDID) Po
Serial Number HE Gow
Unique Chip ID (ECID) a 8006
WiFi MAC Address 98:ca:33:1¢:5b:3f
Bluetooth MAC Address 98:ca:33:1¢:5b:57
IMEI N/A
Data Partition Size 1.93GB (2076848128 bytes)
Lock State Before First Unlock
Agent Version 1.15.7
Backup State iCloud Backup, Last Backup Date: Never
Owner Name lilia turcan
Accounts turcan4849@gmail.com
1/26/2021

Open extraction in Physical Analyzer version 7.38.
Create UFED reader report for the investigator.

1/27/2021

1B81
iPhone 12 Passcode protected

The phone was passcode protected and required a GrayKey extraction. GrayKey version 1.6.9 was
successful completing a File System Extraction. The extraction was opened using Physical Analyzer
version 7.38 where a UFED Reader report was created for the investigator. The extraction and UFED
report were saved to CART staging media.

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163709

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 15 of 22   Page ID
Notes
290-LA-3280255

SUID 238390 & 238399
ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)

Page

15 of 22 PageID

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

GrayKey Progress Report

Evidence ID: 1B81-GP
Examiner Name: FE Greg Parra

GrayKey Serial #: 82c21f2d4991a20
GrayKey Software: OS Version 1.6.9, App Bundle: 1.15.8
Report generation time: 2021-01-27 18:47:41 UTC

Target Device Information

oo

eS)

Device Name

iPhone

Software Version

14.1 [18A8395]

Model

iPhone 12 [iPhone13,2 DS3gAP]

Unique Device ID (UDID)
Serial Number

401E

KODY1

Unique Chip ID (ECID)
‘WiFi MAC Aderess

18:10.93:73:c4:84

Bivetooth MAC Address

[t8.1093:72.81.07

Phone Number 2262

Data Partition Size 18.16GB (19502047232 bytes)

Lock State After First Unlock

Agent Version 1.158

Backup State iTunes Backup, Not Encrypted, Last Backup Date: Never
Owner Name Mary Abelian

Accounts mary abelian@yahoo.com

Message Retention Duration

Apple ID

iCloud account present

Owner Name

Last Activation Time

Model number

Last user ICCID

Last used MSISDN

IMEI
Unique ID
Serial
AirDrop ID

Time Zone

Advertising Id (IDFA)

Location Services Enabled

Wi-Fi MAC address

Forever
mary.abelian@yahoo.com
True

iPhone

11/5/2020 2:46:45 AM(UTC+0)

D53gAP

EE 1726
M2 262
ES 201:
BODY

(UTC-08:00) Los_Angeles (America)
#17ABDFO73-A596-4345-9970-2FB4A0EED951
True

F8:10:93:73:C4:8D

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

DOJ_PROD_0000163710

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 16 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

MAC address FA:10:93:6C:5C:22

MAC address FA:10:93:6C:5C:DD

ICCID a 736
MSISDN a? 252

IMsI ¢134

1B85
iPhone7 Passcode protected

Process with Graykey GrayKey Serial #: 82c21ff2d4991a20 GrayKey Software: OS Version: 1.6.8.1, App
Bundle: 1.15.7.

GrayKey Progress Report
Evidence ID: 1B85-GP

GrayKey Serial #: 82c21ff2d4991a20
GrayKey Software: OS Version: 1.6.9, App Bundle: 1.15.8
Report generation time: 2021-01-27 16:17:12 UTC

Target Device Information

Device Name iPhone

Software Version 13.6 [17G68]

Model iPhone 7 (Global) [iPhone9,1 D10AP]

‘Daiivo Qggice 1D (UDO) | fa
erlat Nuiviber | iow

Unique Chip ID (ECID) | i 0952

WiFi MAC Address 10:30:25:d2:aa:9f

Bluetooth MAC Address 10:30:25:d5:58:16

Phone Number 6000

IMEI N/A

Data Partition Size 4.16GB (4469571584 bytes)

Lock State Before First Unlock

Agent Version 1.15.8

Backup State iCloud Backup, Last Backup Date: Never

Owner Name Rich Ayvazyan

Accounts rich@fliper.com

Passcode found was J The extraction was opened using Physical Analyzer version 7.38 where a
UFED Reader report was created for the investigator.

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163711

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 17 of 22   Page ID
Notes
290-LA-3280255

SUID 238390 & 238399
ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

1B82

iPhone 12 Passcode protected

Tried passcode Jj (same passcode found by GrayKey for 1B85) Successful

Process with Graykey Serial #: 82c21ff2d4991a20 GrayKey Software: OS Version: 1.6.8.1, App Bundle:

d Feu Boy

GrayKey Progress Report

Evidence ID: 1B82-GP

Examiner Name: FE Greg Parra

GrayKey Serial #: 82¢2192d4991a20
GrayKey Software: OS Version: 1.6.9, App Bundle: 115.8
Report generation trne. 2021-01-27 16.48.30 UTC

Target Device Information

Device Name 18183s iPhone
Software Version 14.1[18A8395]
Model iPhone 12 [iPhone13,2 D53gAP]

Unique Device ID (UDID) —— TT
Serial Number ODYO
Unique Chip ID (ECID) 2014

WiFi MAC Address 44:90:bb:12:2b:85

Bluetooth MAC Aderess 44-90:bb:09:51:84

Phone Number ~| 2224

IMEI 3489

Data Partition Size 14.17GB (15216377856 bytes)

Lock State After First Uniock

Agent Version 1.158

Backup State iCloud Backup, Last Backup Date: Never

Owner Name Richard Ayvazyan

Accounts rich@fliper.com, ayva11@yahoo.com, rich@inceptionfund com

Message Retention Duration
Apple ID

iCloud account present
Owner Name

Last Activation Time

Model number

Last user ICCID

Last used MSISDN

IMEI

Unique ID

Forever
rich@fliper.com
True

18183’s iPhone

11/5/2020 12:25:05 AM(UTC+0)

D53gAP

EE 621°

ES 001

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

DOJ_PROD_0000163712

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 18 of 22   Page ID
Notes
290-LA-3280255

SUID 238390 & 238399
ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Serial

AirDrop ID

Advertising Id (IDFA) #1
Bluetooth device address
Location Services Enabled
VoiceMemo Size (bytes)
VoiceMemo Entries
UserData Size (bytes)
UserData Entries
Storage available (Bytes)
Book Size (bytes)

Book Entries

Application Size (bytes)
Application Entries

Logs Size (bytes)

Logs Entries

Ringtone Size (bytes)
Ringtone Entries
Proofing Size (bytes)
Proofing Entries

Storage capacity (Bytes)

Sync host name Computer:

Wi-Fi MAC address
MAC address
MAC address

ICCID

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

Yo

CD706079-67CC-478F-B8B3-63289281E119

<string>44:90:BB:09:51:84</string>
True

LAPTOP-25T8112K\User: 18183
44:90:BB:12:2B:85
46:90:BB:0F:1B:3F

46:90:BB:0F:1B:CO

SE &>1<

DOJ_PROD_0000163713

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 19 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

MSISDN a 2224

IMSI a 7280

Time Zone (UTC-08:00) Los_Angeles (America)
Find my iPhone enabled True

ue SCs

iPhoneil Passcode protected

Process with Graykey GrayKey Serial #: 82c21ff2d4991a20 GrayKey Software: OS Version: 1.6.8.1, App
Bundle: 1.15.7.

GrayKey Progress Report
Evidence ID: 1B83-GP

Examiner Name: FE Greg Parra
GrayKey Serial #. 62c21ff2d4991a20

GrayKey Software: OS Version: 1.6.9, App Bundle: 1.15.8
Report generation time: 2021-01-27 23:00:10 UTC

Target Device Information

Device Name iPhone
Software Version 14.1 [18A8395]
Model iPhone 11 [iPhone12.1 N104AP]

Unique Device ID (UDID)
Serial Number

Unique Chip ID (ECID)
WiFi MAC Address
Bluetooth MAC Address
Phone Number

IMEI
Data Partition Size 110.18GB (118309068800 bytes)
Lock State After First Unlock
Agent Version 1.158
Backup State iCloud Backup, Last Backup Date: Never
Owner Name Ayvazyan
Accounts

2/1/2021

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163714

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 20 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

Open extraction using Physical Analyzer version 7.38

Enter the password below or click Load from file to load a list of passwords
from a text file (dictionary). The file must include a list of passwords, with each
password on a separate line. Click Cancel to skip this specific app and continue

decoding.
[Load from file Cancel |
Message Retention Duration Forever
Apple ID Se
iCloud account present True
Owner Name iPhone
Last Activation Time 10/31/2020 10:26(UTC+0)
Model number N104AP
Last used MSISDN PF
Last user ICCID PO
Unique ID es
IMEI es
Serial FP
AirDrop ID Po
Time Zone JUTC-08:00) Los_Angeles (America)
Advertising Id (IDFA) #1 Pe
Advertising Id (IDFA) #2 ee
Bluetooth device address PO
Location Services Enabled True
VoiceMemo Size (bytes) (e)

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163715

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 21 of 22   Page ID
Notes
290-LA-3280255

SUID 238390 & 238399
ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)

(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

VoiceMemo Entries
UserData Size (bytes)
UserData Entries
Storage available (Bytes)
Book Size (bytes)

Book Entries
Application Size (bytes)
Application Entries
Logs Size (bytes)

Logs Entries

Ringtone Size (bytes)
Ringtone Entries
Proofing Size (bytes)
Proofing Entries
Storage capacity (Bytes)
Wi-Fi MAC address
MAC address

MAC address

ICCID

MSISDN

IMSI

Automatic time zone
Find my iPhone enabled

Detected Phone Model

o

oO

S

oO

oO

True
True

iPhone 11

The extraction was opened using Physical Analyzer version 7.38 where a UFED Reader report was

created for the investigator.

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER

DOJ_PROD_0000163716

EXHIBIT E
Case 2:20-cr-00579-SVW     Document 439-6     Filed 06/07/21     Page 22 of 22   Page ID
Notes

290-LA-3280255

SUID 238390 & 238399

ITS-FE Gregory J Parra

(Note, SUID 238399 include 1B130, 1B131 & 1B132)
(Note, SUID 238390 include 1B20, 1B21, 1B79, 1B80, 1B81, 1B82, 1B83, 1B85, 1B94 & 1B96)

The cell phone extractions and UFED reports were copied to USB hard drives previously provided by the
investigative team.

CONFIDENTIAL INFORMATION SUBJECT TO PROTECTIVE ORDER DOJ_PROD_0000163717

EXHIBIT E

File and source

File: gov.uscourts.cacd.802533.439.6.pdf
Size: 9,047,004 bytes
SHA-256: 0cd56d1d3d7f21f90cbedd7abde4c60026a80bc1880b60f8aca9b8a5e0c4494e
Our copy: gov.uscourts.cacd.802533.439.6.pdf
Original: PACER (login required)