Forensic Investigation Findings: Incident Reconstruction, Root Cause, and Expert Witness Report

Joshua A. Wortz

doi:10.5281/zenodo.22287680

Forensic Investigation Findings: Incident Reconstruction, Root Cause, and Expert Witness Report

Forensic investigation report and expert witness documentation synthesizing digital evidence, chronological timeline reconstruction, and findings.

Author

Joshua A. Wortz MSCOL, CISSP ORCID

Institution / Context University of San Diego

Format / Report Type Academic Research Paper / CSOL590

Published / Revised February 16, 2026 (Rev. Oct 2026)

Download PDF DOI 10.5281/zenodo.22287680 Open in New Tab Cite Paper

Table of Contents

Abstract
Research Paper Body
- References

Abstract

This investigation provides a forensic analysis of a mobile device associated with “THISISDIFIR” to determine the user’s location on April 5, 2020, identify communications with Josh Hickman, and investigate any physical presence in California. The device underwent a thorough timeline analysis of system logs, application notifications, and geolocation artifacts.

Research Paper Body

CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL DATE @ “MMMM d, yyyy” CSOL590 – Final Forensics Report JOSHUA WORTZ LEAD INVESTIGATOR [email protected]

CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL TABLE OF CONTENTS 1 Executive Summary 1 2 Evidence and Custodians 1 2.1 Evidence 1 2.2 Custodians 1 3 Methodology 1 3.1 Preservation 1 3.2 Analysis 2 4 Findings 2 4.1 Location 2 4.2 Communications with Hickman 2 5 Ethical Implications 3 5.1 Privacy 3 5.2 Informed Consent 3 6 Conclusions 3

CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL 1 EXECUTIVE SUMMARY This investigation provides a forensic analysis of a mobile device associated with “THISISDIFIR” to determine the user’s location on April 5, 2020, identify communications with Josh Hickman, and investigate any physical presence in California. The device underwent a thorough timeline analysis of system logs, application notifications, and geolocation artifacts. Key Findings: ● Location: On April 5, 2020, the device was consistently located in North Carolina, specifically the Apex/New Hill area. ● Communication: No digital communication between the client and Josh Hickman was identified on the date in question. ● California Presence: There is no forensic evidence (GPS, cell tower, or IP logs) indicating the device was in California on April 5, 2020. 2 EVIDENCE AND CUSTODIANS 2.1 EVIDENCE ● Device Type: iPhone (Hardware Model N69AP). ● Serial Number: 17193901029. ● Operating System: iOS 13.3.1. ● Acquisition Date: April 6, 2020. ● Hash Value (MD5): CDCF0AF43A3285191E56BB843488AFE5 2.2 CUSTODIANS ● Name: This Is DFIR. ● Contact Info: [email protected].

CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL 3 METHODOLOGY 3.1 PRESERVATION Evidence was preserved using a logical extraction method via Magnet AXIOM (v. 4.0). The device was placed in a Faraday bag immediately upon seizure to prevent remote wiping or signal interference. 3.2 ANALYSIS Chronological Reconstruction: A unified timeline was created by merging artifacts from the com.apple.routined database and system KnowledgeC.db. Application Audit: A detailed review of application focus states and notifications was conducted to determine active usage versus background processes. Data Visualization and Review: Results were cross-referenced and viewed in Cellebrite Reader (Cellebrite, 2023) for comprehensive reporting. Keyword Search: Specific searches for “Hickman” and “California” were performed across all text-based databases. 4 FINDINGS 4.1 LOCATION Artifacts from the Health App and RoutineD cache confirm the device was in North Carolina throughout April 5, 2020: ● Morning (9:00:54 AM UTC-4): Location recorded at latitude 35.6592, longitude -78.8728 (New Hill Rd, NC). ● Evening (8:26:05 PM UTC-4): Location recorded at latitude 35.6596, longitude -78.8727 (North Carolina). ● Analysis: These coordinates represent a “Home” or “Work” cluster in North Carolina. There are no travel-related artifacts (e.g., flight bookings in Mail or sudden time zone shifts) suggesting a move to California.

CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL 4.2 COMMUNICATIONS WITH HICKMAN ● Search Results: A global search of SMS/iMessage, WhatsApp, and Call Logs returned zero hits for “Josh Hickman” on 4/5/2020. ● Active Comms: The device was used on this date for YouTube, WhatsApp (notifications only), and Gmail, but none of these interactions involved the individual in question. ● System Activity: The device saw heavy usage between 12:00 PM and 3:00 PM EST, primarily involving media consumption on YouTube and the Apple Clock app. 5 ETHICAL IMPLICATIONS 5.1 PRIVACY The report includes highly specific latitude/longitude data that identifies a private residence. This information is shared only within the context of legal proceedings. 5.2 INFORMED CONSENT The data extraction includes third-party metadata (contacts and group chat info) for individuals who did not consent to the search; investigators must ensure this data is not misused for unrelated inquiries. 6 CONCLUSIONS The comprehensive digital forensic investigation unequivocally establishes the subject device’s physical location on April 5, 2020. Analysis of location data, network logs, and device metadata points conclusively to the device being in North Carolina throughout the requested timeframe. Crucially, the analysis yielded no forensic evidence, such as GPS coordinates, Wi-Fi connection logs, tower triangulation data, or communications metadata, that would support the assertion that the client was physically present in the state of California at any point during the timeframe under scrutiny. Furthermore, there is no recoverable digital evidence (e.g., text messages, email logs, call records, or instant messaging history) demonstrating communication between the client and the individual identified as Josh Hickman during the aforementioned period. The forensic data provides no basis to conclude that any interaction, digital or otherwise, occurred between these two parties as alleged. The digital footprint clearly anchors the device and, by reasonable inference, the client in North Carolina, negating claims of travel to or communication from California.

CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL

References

Apple. (2020). iOS Security Guide (Version 13.3.1). Apple Inc. Cellebrite. (2023). Cellebrite Reader (Version 7.60.0.27) [Computer software]. Cellebrite. Grammarly. (2026). Grammarly (Version 1.2.100) [Computer software]. https://www.grammarly.com The author used Grammarly to check for grammar, spelling, and punctuation errors during the final editing of this document. Magnet Forensics. (2020). Magnet AXIOM (Version 4.0) [Computer software]. Magnet Forensics.

Document Viewer

Cite This Academic Research

Standardized APA 7th Edition reference and RFC-compliant BibTeX entry for scholarly literature reviews, course papers, and citation managers (Zotero, Mendeley, JabRef).

APA 7th Edition

Wortz, J. A. (2026). Forensic Investigation Findings: Incident Reconstruction, Root Cause, and Expert Witness Report. University of San Diego. https://doi.org/10.5281/zenodo.22287680

BibTeX Entry

@techreport{wortz2026csol590prese,
  author      = {Wortz, Joshua A.},
  title       = {Forensic Investigation Findings: Incident Reconstruction, Root Cause, and Expert Witness Report},
  institution = {University of San Diego},
  year        = {2026},
  month       = {February},
  type        = {Academic Research Paper / CSOL590},
  url         = {https://codeandcypher.com/papers/csol590-presentation-of-findings/},
  doi         = {10.5281/zenodo.22287680}
}

Abstract#

Research Paper Body#

References#

Document Viewer

Cite This Academic Research

Abstract

Research Paper Body

References