Carrier-Specific Preservation Requestsrevforensics.com/wp-content/uploads/2018/01/Carrier... · 2017. 10. 11. · RevForensics.com 5911 N Road 400 W, Bargersville IN 46106 317-527-1446

RevForensics.com 5911 N Road 400 W, Bargersville IN 46106 317-527-1446

Carrier-Specific Preservation Requests


AT&T Civil Preservation Request

10-11-2017

RevForensics.com [email protected] 317-527-1446

October 11, 2017

AT&T Mobility

National Court Order Compliance

11760 US Highway 1, Suite 600

North Palm Beach, FL 33408-3029

(800) 635-6840

Fax (888) 938-4715

Dear Sir or Ma’am,

I am conducting an investigation and have identified the phone number 317-555-1212 as likely being pertinent to

this case. Per 18 USC § 2703, I am requesting AT&T Mobility preserve the records for the phone number 317-555-

1212, to include the following:

1. Subscriber information for the number 317-555-1212 including by way of example and not limitation:

a. Subscriber Name

b. Subscriber Address

c. Identifying information such as date of birth, driver’s license number, and/or social security

number

d. Subscriber contact information including email addresses and contact phone numbers

2. Billing and credit information for the phone number 317-555-1212 including by way of example and

not limitation:

a. Method and source of payment information including credit card numbers, electronic funds

transfers, and locations of cash payments

b. Credit information including any credit report run by the provider prior to the authorizing service

3. Service information for the phone number 317-555-1212 including by example and not limitation:

a. Purchase and activation location

b. Types of service subscribed to

c. Additional phone numbers associated with the same account

d. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the account

4. Call Detail Records for the wireless number 317-555-1212 for the days of 06/01/2015 to 07/01/2015,

Eastern Time, including:

a. Cellular calls,

b. SMS/MMS messages

c. Data communication

d. Tower locations (LAC/CID) and azimuth for the sectors accessed during the communication

5. Any data in the AT&T cloud services associated with the wireless number 317-555-1212, including by

way of example and not limitation

a. SMS, MMS,

b. Emails communications

6. Location of the phone with the wireless number 317-555-1212 using Network Event Location System

(NELOS) and Mobile Locator Tool data including reliability factors for the communication for the

days of 06/01/2015 to 07/01/2015, Eastern Time.

7. Voice Mail Messages including content


8. A detailed definitions page which identifies all information in the records

I will follow up with a court order or subpoena as needed. Thank you for your assistance.

Sincerely,

Benjamin Bierce

Revelation Cellular Forensics LLC

317-527-1446

[email protected]

www.revforensics.com


Notes for Preparing the Legal Demand

• AT&T maintains records for the following periods

o Cell sites for voice, text, and data back to July 2008

o NELOS, about 30 days

o They do not store the content of text messages at all

• AT&T will supply the records with cell tower information from a subpoena, but a court order will result in

a quicker turnaround.

• Be sure to request the records in digital format, specifically in .txt format, on a CD with the preparer’s

signature on it and a notarized copy of the Affidavit of Custodian of Records.

• AT&T provides digital records in PDF format by default, but will provide them in .txt format upon request.

For analysis, I much prefer the .txt format.

• Request at least 30 days of records if you can justify it. A month of records is a large enough sample to

establish calling patterns to identify the most frequently called numbers. Get more if you can. The larger

the sample, the better the analysis.

• The following is the text I place in the notes of the fax coversheet

o This is in reference case number xxx. Please provide the information in .txt format. Please email

the records to me so I can begin working on them immediately. For court purposes, I need a

certified copy as well. Please provide all the records along with the cell site locations in a single

disc, and have the custodian of records sign his or her name on the disc. Please complete the

Affidavit of Custodian of Records and return the original copy with the records. The information

may be mailed to:

• If you are having Revelation Cellular Forensics conduct the analysis you may want to include text like the

following:

o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of these

records. I respectfully request you allow Mr. Bierce to contact you directly with any questions

concerning these records.


Metro PCS Civil Preservation Request

10-11-2017


October 11, 2017

Metro PCS/T-Mobile, USA

Law Enforcement Relations

4 Sylvan

Parsippany, NJ 07054

(973) 292-8911

Fax (973) 292-8697


I am conducting an investigation in a civil case and have identified the phone number 317-555-

1212 as likely being pertinent to this case. Per 18 USC § 2703, I am requesting Metro PCS/T-

Mobile, USA preserve the records for the phone number 317-555-1212, to include the following:

1. Subscriber information for the number 317-555-1212 including by way of example and

not limitation:

a. Subscriber Name


c. Identifying information such as date of birth, driver’s license number, and/or

social security number

d. Subscriber contact information including email addresses and contact phone

numbers

2. Billing and credit information for the phone number 317-555-1212 including by way of

example and not limitation:

a. Method and source of payment information including credit card numbers,

electronic funds transfers, and locations of cash payments

b. Credit information including any credit report run by the provider prior to the

authorizing service

3. Service information for the phone number 317-555-1212 including by example and not

limitation:




d. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated

with the account


4. Call Detail Records for the wireless number317-555-1212 for the days of 1/1/2015

to2/1/2015, Eastern Time, including:

a. Cellular calls,

b. SMS/MMS messages


d. Tower locations (LAC/CID) and azimuth for the sectors accessed during the

communication

5. A list of all T-Mobile cell towers with latitude, longitude, address, and sector directions

and beam widths

6. Voice Mail Messages and Text Messages including content


8. Please provide records in Eastern Time

I will follow up with a search warrant as needed. Thank you for your assistance.

Sincerely,

Benjamin Bierce


317-527-1446

[email protected]




• Metro PCS/T-Mobile maintains records for the following periods

o Cell sites for voice two years

o No cell sites for text messages or data


• Metro PCS/T-Mobile requires a court order to produce the records.

• Be sure to request the records in digital format on a CD with the preparer’s signature on it and a notarized

copy of the Affidavit of Custodian of Records.

• Metro PCS/T-Mobile provides the records in Microsoft Excel format.

• A spreadsheet containing all the T-Mobile cell sites is necessary for the analysis, and T-Mobile is

inconsistent about sending them. Follow up contact may be necessary but no additional legal demand

would be needed.




• The following is the text I place in the notes of the fax coversheet:

o This is in reference case number xxx. Please provide the information in digital format, either in

Microsoft Excel, or a format that could be exported to Excel. If you provide the information in a

format other than Excel please provide instructions to export to excel. Please email the records to

me so I can begin working on them immediately. For court purposes I need a certified copy as

well. Please provide all the records along with the cell site locations in a single disc, and have the

custodian of records sign his or her name on the disc. Please complete the Affidavit of Custodian

of Records and return the original copy with the records. The information may be mailed to:

• If you are having Revelation Cellular Forensics conduct the analysis you may want to include text like the

following:





Sprint Civil Preservation Request

10-11-2017


February 1, 2014

Sprint Corporation

Security & Subpoena Compliance

6480 Sprint Parkway

MS: KSOPHM0216

Overland Park, KS 66251

(800) 877-7330

Fax (816) 600-3111


I am conducting an investigation and have identified the phone number 317-555-1212 as likely

being pertinent to this case. Per 18 USC § 2703, I am requesting Sprint Corporation preserve the

records for the phone number 317-555-1212, to include the following:

1. Subscriber information (Expanded) for the number 317-555-1212 including by way

of example and not limitation:

a. Subscriber Name





numbers

2. Billing and credit information (Payment Information) for the phone number 317-555-

1212 including by way of example and not limitation:




authorizing service

3. Service information for the phone number 317-555-1212 including by example and

not limitation:





with the account


4. Call Detail Records for the wireless number 317-555-1212 for the days of 07/01/2015

to 08/01/2015, Eastern Time, including by example and not limitation:

a. Cellular calls (Call Detail Records with Cell Site Location)

b. SMS/MMS messages

c. Data communication (IPDR w/ Cell Site, Web Site Address Report)

d. Tower locations (NEID, Cell Number, Sector Number, eNode) and azimuth for

the sectors accessed during the communication

5. Voice Mail Messages including content (Stored Voice Mail Reproduction)

6. PCMD (Per Call Measurement Data) for the cellular phone number 317-555-1212 for

the days of 07/01/2015 to 08/01/2015, Eastern Time, to include reliability factors for

the communication


I will follow up with a court order or subpoena as needed. Thank you for your assistance.

Sincerely,

Benjamin Bierce


317-527-1446

[email protected]




• Sprint maintains records for the following periods

o Cell sites for voice only for 18 to 24 months



o PCMD (Per Call Measurement Data) is stored for 14 days

• Sprint requires a court order to produce the records.



• Sprint provides the records in Microsoft Excel format.

• A spreadsheet containing all the Sprint cell sites is necessary for the analysis, and Sprint is inconsistent

about sending them. Follow up contact may be necessary but no additional legal demand would be needed.












• If you are having Bierce Associates conduct the analysis you may want to include text similar to the

following:





T-Mobile Civil Preservation Request

10-11-2017


October 11, 2017

T-Mobile, USA

Law Enforcement Relations

4 Sylvan

Parsippany, NJ 07054

(973) 292-8911

Fax (973) 292-8697



1212 as likely being pertinent to this case. Per 18 USC § 2703, I am requesting T-Mobile, USA

preserve the records for the phone number 317-555-1212, to include the following:

1. Subscriber information for the number 317-555-1212 including by way of example and

not limitation:

a. Subscriber Name





numbers

2. Billing and credit information for the phone number 317-555-1212 including by way of

example and not limitation:




authorizing service

3. Service information for the phone number 317-555-1212 including by example and not

limitation:





with the account


4. Call Detail Records for the wireless number317-555-1212 for the days of 1/1/2015

to2/1/2015, Eastern Time, including:

a. Cellular calls,

b. SMS/MMS messages


d. Tower locations (LAC/CID) and azimuth for the sectors accessed during the

communication

5. A list of all T-Mobile cell towers with latitude, longitude, address, and sector directions

and beam widths

6. Voice Mail Messages and Text Messages including content


8. Please provide records in Eastern Time


Sincerely,

Benjamin Bierce


317-527-1446

[email protected]




• T-Mobile maintains records for the following periods

o Cell sites for voice and text, 2 years

o No cell sites for or data


• T-Mobile requires a court order to produce the records.



• T-Mobile provides the records in Microsoft Excel format.

• A spreadsheet containing all the T-Mobile cell sites is necessary for the analysis, and T-Mobile is

inconsistent about sending them. Follow up contact may be necessary but no additional legal demand

would be needed.













following:





Verizon Civil Preservation Request

10-11-2017


August 1, 2015

Verizon Wireless

Law Enforcement Resource Team

180 Washington Valley Rd.

Bedminster, NJ 07921

(800) 451-5242

Fax (888) 667-0026



1212 as likely being pertinent to this case. Per 18 USC § 2703, I am requesting Verizon Wireless

preserve the records for the phone number 317-555-1212, to include the following:

1. Subscriber information for the number 317-555-1212 including by way of example

and not limitation:

a. Subscriber Name





numbers

2. Billing and credit information for the phone number 317-555-1212 including by way

of example and not limitation:




authorizing service

c. Payment Activity

d. Payment History

e. Auto Bill Copy

3. Service information for the phone number 317-555-1212 including by example and

not limitation:


b. Activation/Deactivation Dates

c. Types of service subscribed to


d. Additional phone numbers associated with the same account (Other Numbers on

Account)

e. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated

with the account (Device ID)

4. Call Detail Records for the wireless number 317-555-1212 for the days of

06/01/2015 to 07/01/2015, Eastern Time including:

a. Cellular calls, (Cell-Site Incoming, Outgoing)

b. SMS/MMS messages (Historical MMS Detail, Text Message Detail, Auto Text

Message Content, Auto Picture Content, Picture content, Auto Picture Detail,

Picture Message Detail)

c. Data communication (IP Destination, IP Session)

d. Tower locations (Switch/Element, Cell Numbers, Sector Numbers) and azimuth

for the sectors accessed during the communication

5. Voicemail Messages including content (Voicemail Password Reset)

6. RTT (Round Trip Time) for the cellular phone number 317-555-1212 for the days of

06/01/2015 to 07/01/2015, Eastern Time, to include reliability factors for the

communication

7. Any data in the Verizon cloud services associated with the wireless number 317-

555-1212, including by way of example and not limitation

a. SMS, MMS,

b. Emails communications



Sincerely,

Benjamin Bierce


317-527-1446

[email protected]




• Verizon maintains records for the following periods

o Cell sites for voice only for 12 months


o They do the content of text messages for 7 days

o RTT (Round Trip Time) is stored for 7 days

• Verizon will honor a subpoena, but a court order will result in a faster return.



• Verizon provides the records in Microsoft Excel (.csv) format.













following in a cover sheet or memo:





Bierce CV

Benjamin Bierce


317-527-1446

[email protected]

Professional Experience

• Owner, Revelation Cellular Forensics, LLC, 2012 to Present

• Investigator, Franklin, Indiana Police Department, 2016 to Present

• Detective, Computer & Digital Forensics Unit, Indianapolis Metropolitan Police Department,

2015 to 2016

• Detective, Homicide/Robbery Branch, Indianapolis Metropolitan Police Department, 2008 to

2015

• Police Officer, Indianapolis Metropolitan Police Department/Indianapolis Police Department,

2001 to 2016

• Special Agent, U.S. Army Criminal Investigation Division Command (CID), 2003 to 2011

Training and Education

• Mobile Device Examiner, National Computer Forensics Institute, US Secret Service, 2017

• Basic Mobile Device Investigations, National Computer Forensics Institute, US Secret

Service, 2015

• Mobile Device Investigation Program, Federal Law Enforcement Training Center, 2014

• Cell Phone Data and Mapping, Police Technical, 2014

• Smartphone Forensics and Advanced Cellular Technology, Public Agency Training Council,

2012

• Foundations of Intelligence Analysis Training, Department of Homeland Security/National

White Collar Crime Center, 2012

• Cyber-Investigations 105 (Basic Cell Phone Investigations), National White Collar Crime

Center, 2010

• U.S. Army Criminal Investigation Division Command, Basic Warrant Officer Course, 2010

• Cyber-Investigations 101 (Secure Techniques for Onsite Preview), National White Collar

Crime Center, 2010

• Bachelor’s Degree in Criminal Justice, Liberty University, 2008

• Detective Course, Indianapolis Metropolitan Police Department, 2008

• U.S. Army Criminal Investigation Division Command Special Agent Course, 2005

Certifications

• Cellebrite Certified Operator (CCO), August, 2017 to December 2019

• MSAB XRY Level 2 Certification, August, 2017 to August, 2019

Speaking Engagements

• Indiana Continuing Legal Education Forum, Advanced Family Law, July, 2017

• Cincinnati Bar Association, Cell Phone Evidence in Civil Litigation, June, 2017

• Akron Bar Association, Cell Phone Evidence in Criminal Litigation, June, 2017

• Louisville Bar Association, Cell Phone Evidence in Civil Litigation, May, 2017

• Chicago Bar Association, Cell Phone Evidence in Civil Litigation, April, 2017

• Monroe County (IN) Bar Association, Bench Bar Conference, Cell Phone Evidence in Civil

Litigation, February, 2017

• Indiana Continuing Legal Education Forum, Family Law Institute, Cell Phone Evidence in

Family Law, October, 2016

• Ohio State Bar Association, Webinar, Cell Phone Record Analysis in support of Criminal

Cases, June, 2016

• Allen County (IN) Bar Association, Cell Phone Record Analysis in support of Litigation,

June, 2016

• Ohio State Bar Association, Webinar, Cell Phone Record Analysis in support of Civil

Litigation, May, 2016

• Indiana Continuing Legal Education Forum, Year in Review Conference, Preserving and

Obtaining Cell Phone Records, December, 2015

• Indiana Continuing Legal Education Forum, Preserving and Obtaining Cell Phone Records,

June, 2015

• Defense Trial Counsel of Indiana, Annual Conference, Trial Tactics, November, 2014

• Indiana University Law School, Guest Speaker, eDiscovery, June, 2014

• Defense Trial Counsel of Indiana, Annual Conference Breakout Session, November 2013

• Indiana Continuing Legal Education Forum, Using Cell Phone Records in Civil Litigation,

October, 2013

• US Attorney's Law Enforcement Conference, Homicide Case Study, September, 2013

• Marion County Prosecutors Office, Cell Phone Training for Prosecutors, July, 2013

• ITT Technical Institute, Guest Speaker, Criminal Justice, July 2013

Trial Testimony

• State v. Miles Toran, 49G05-1204-MR-025631, Marion County, Indiana

• State v. Maron Jackson, 49G02-1303-MR-018733, Marion County, Indiana

• State v. Lamar Wooden, 49G05-1301-MR-001900, Marion County, Indiana

• State v. Daryl Gilbert, 49G02-1209-MR-062371, Marion County, Indiana

• State v. Daniel Hoskins, 49G02-1211-MR-078412, Marion County, Indiana

• State v. Carlton Hart, 49G04-1211-MR-080845, Marion County, Indiana

• State v. Ryan Clark, 49G01-1309-MR-063573, Marion County, Indiana

• State v. Donna Fitzgerald, 49G03-1305-FB-028125, Marion County, Indiana

• State v. James Wade, 49G05-1404-MR-018355, Marion County, Indiana

• State v. Omar Davis, 49G05-1412-F1-055698, Marion County, Indiana

• State v. Cortez Jones, 49G05-1308-MR-055492, Marion County, Indiana

• State v. Philip Garrett, 49G02-1306-MR-036144, Marion County, Indiana

• State v. Kenneth Brittain, 49G05-1304-MR-027966, Marion County, Indiana

• State v. Heidi Carpenter, 49G02-1209-MR-065363, Marion County, Indiana

• State v. Marchello Heard, 49G02-1211-FA-078732, Marion County, Indiana

• State v. Dominique Hamler, 49G04-1211-MR-080841, Marion County, Indiana

• State v. Desmond Aaron, 49G20-1502-F4-005316, Marion County, Indiana

• State v. Anthony Spearman, 49G05-1405-MR-022788, Marion County, Indiana

• State v. Devin Brookins, 49G05-1405-MR-024581, Marion County, Indiana

• State v. James Jenkins, 49G05-1410-MR-046576, Marion County, Indiana

• State v. Eric Johnson, 49G02-1402-MR-006525, Marion County, Indiana

• State v. John Webb, 49G02-1307-MR-043402, Marion County, Indiana

• State v. Bob Leonard, 02D05-1502-MR-000001, Allen County, Indiana

• State v. Bryant Dowdy, 49G01-1301-MR-002706, Marion County, Indiana

• State v. Nicko Bryant-Williams, 49G01-1411-MR-051328, Marion County, Indiana

• State v. Jasen Lockwood, 49G04-1504-F4-013182, Marion County, Indiana

• State v. John Means, 49G05-1409-MR-044073, Marion County, Indiana

• State v. Desmond Aaron. 49G05-1506-MR-019249, Marion County, Indiana

Depositions

• State v. Anthony Spearman, 49G05-1405-MR-022788, Marion County, Indiana

• State v. Cortez Jones, 49G05-1308-MR-055492, Marion County, Indiana

• State v. William Rainsberger, 49G01-1405-MR-026747, Marion County, Indiana

• State v. James Wade, 49G05-1404-MR-018355, Marion County, Indiana

• State v. Kenneth Brittain, 49G05-1304-MR-027966, Marion County, Indiana

• State v. Richard Burns, 49G05-1403-MR-014307, Marion County, Indiana

• State v. Kenneth Rackemann, 49G01-1402-MR-009106, Marion County, Indiana

• State v. Eric Johnson, 49G02-1402-MR-006525, Marion County, Indiana

• State v. Charles Wade, 49G06-1311-FA-075199, Marion County, Indiana

• State v. Maron Jackson, 49G02-1303-MR-018733, Marion County, Indiana

Relevant Experience and Activities

Since 2010 I have analyzed over 1200 sets of phone records in both criminal and civil cases.

I have testified regarding cell phone records in 28 criminal jury trials.

In 2012 I established a program to obtain and analyze phone records for the Indianapolis

Metropolitan Police Department. I have testified in homicide, robbery, arson, and sex crimes trials.

From 2012 to present I have been involved with the Kairos Prison Ministry, where I regularly give

talks and presentations.

From 2010 to present, my wife and I have coordinated Financial Peace University at our church,

where we give presentations, and guide and mentor students through a 13 or 9 week course.

From 2004 to 2011 I was the Training Officer or Training Noncommissioned Officer for the 378th

MP Detachment (CID), U.S. Army Reserve. I was responsible for establishing and implementing the

unit’s training program. I supervised soldiers in the development and presentation of individual

classes.

Documents

Carrier-Specific Preservation Requestsrevforensics.com/wp-content/uploads/2018/01/Carrier... · 2017. 10. 11. · RevForensics.com 5911 N Road 400 W, Bargersville IN 46106 317-527-1446