Sept 16 2025 We Know DOJ CRIMS Was Copied and J Needs Forensic Imaging of Phone
Areas to Look back on - what More Info is Needed?
What We’ve Learned since
-
D says DOJ CRIMS was copied
How This Connects and Strengthens Previous Arguments
Instructions
Put device in airplane mode and leave it on.
Photograph device, SIM ICCID,
https://www.wikihow.com/Check-Your-iPhone’s-ICCID
Settings ⇒ General ⇒ About ⇒ ICCID
wifi router logs for past 20 days at debug level, and any relevant direct messages. Timestamp photos or leave metadata intact
Have her take a full device image as forensic bit-for-bit or If unavailable she can make an encrypted local backup iOS via iTunes/Finder.
I’ll need pcap covering the suspect period and DHCP leases with that log history on her router.
SMS/call logs and messaging app metadata tell her don’t bother to Include Signal/WhatsApp because they won’t be verifiable.
Any accounts or access tokens. She can take a picture of logged-in accounts in settings.
Battery and data usage reports by app for the timeframe in question she suspects any intercepts.
File system artifacts created or modified in that window.
Check permissions for apps that can read SMS, contacts, mic, camera, accessibility. Any anomalistic permission photograph.
She should check data usage spikes per app during time since she first physically interacted till now.
Check router admin for unknown MAC addresses or frequent reconnects.
After she gets that gathered for me have her put all exported files into a single folder. Make sure she generates 256 hashes for each file and make a text file attesting she collected each herself and when.
Replace her router and modem but keep current ones in same state. Make record of when she did this and sign it.
She can turn off the phone and make signed record and seal it. It’s important you stress she should not break chain of custody by giving them to anyone without written signed record.
Make sure she does not factory-reset or install anything or wipe any content before sealing it.