--- title: "Forensic Investigation Findings: Incident Reconstruction, Root Cause, and Expert Witness Report" date: 2026-02-16 canonical: "https://codeandcypher.com/papers/csol590-presentation-of-findings/" author: "Joshua A. Wortz" institution: "University of San Diego" report_type: "Academic Research Paper / CSOL590" doi: "10.5281/zenodo.22287680" pdf_url: "https://codeandcypher.com/papers/csol590-presentation-of-findings.pdf" description: "Forensic investigation report and expert witness documentation synthesizing digital evidence, chronological timeline reconstruction, and findings." --- # Forensic Investigation Findings: Incident Reconstruction, Root Cause, and Expert Witness Report **Author:** Joshua A. Wortz, MSCOL, CISSP ([ORCID: 0009-0003-6722-1019](https://orcid.org/0009-0003-6722-1019)) **Institution:** University of San Diego **Publication Date:** February 16, 2026 **DOI:** [10.5281/zenodo.22287680](https://doi.org/10.5281/zenodo.22287680) **PDF Download:** [Full Research Paper PDF](https://codeandcypher.com/papers/csol590-presentation-of-findings.pdf) --- ## Abstract This investigation provides a forensic analysis of a mobile device associated with "THISISDIFIR" to determine the user's location on April 5, 2020, identify communications with Josh Hickman, and investigate any physical presence in California. The device underwent a thorough timeline analysis of system logs, application notifications, and geolocation artifacts. --- ## Research Paper Body CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL DATE \@ "MMMM d, yyyy" CSOL590 – Final Forensics Report JOSHUA WORTZ LEAD INVESTIGATOR JWORTZ@SANDIEGO.EDU CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL TABLE OF CONTENTS 1 Executive Summary 1 2 Evidence and Custodians 1 2.1 Evidence 1 2.2 Custodians 1 3 Methodology 1 3.1 Preservation 1 3.2 Analysis 2 4 Findings 2 4.1 Location 2 4.2 Communications with Hickman 2 5 Ethical Implications 3 5.1 Privacy 3 5.2 Informed Consent 3 6 Conclusions 3 CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL 1 EXECUTIVE SUMMARY This investigation provides a forensic analysis of a mobile device associated with "THISISDIFIR" to determine the user's location on April 5, 2020, identify communications with Josh Hickman, and investigate any physical presence in California. The device underwent a thorough timeline analysis of system logs, application notifications, and geolocation artifacts. Key Findings: ● Location: On April 5, 2020, the device was consistently located in North Carolina, specifically the Apex/New Hill area. ● Communication: No digital communication between the client and Josh Hickman was identified on the date in question. ● California Presence: There is no forensic evidence (GPS, cell tower, or IP logs) indicating the device was in California on April 5, 2020. 2 EVIDENCE AND CUSTODIANS 2.1 EVIDENCE ● Device Type: iPhone (Hardware Model N69AP). ● Serial Number: 17193901029. ● Operating System: iOS 13.3.1. ● Acquisition Date: April 6, 2020. ● Hash Value (MD5): CDCF0AF43A3285191E56BB843488AFE5 2.2 CUSTODIANS ● Name: This Is DFIR. ● Contact Info: thisisdfir@gmail.com. CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL 3 METHODOLOGY 3.1 PRESERVATION Evidence was preserved using a logical extraction method via Magnet AXIOM (v. 4.0). The device was placed in a Faraday bag immediately upon seizure to prevent remote wiping or signal interference. 3.2 ANALYSIS Chronological Reconstruction: A unified timeline was created by merging artifacts from the com.apple.routined database and system KnowledgeC.db. Application Audit: A detailed review of application focus states and notifications was conducted to determine active usage versus background processes. Data Visualization and Review: Results were cross-referenced and viewed in Cellebrite Reader (Cellebrite, 2023) for comprehensive reporting. Keyword Search: Specific searches for "Hickman" and "California" were performed across all text-based databases. 4 FINDINGS 4.1 LOCATION Artifacts from the Health App and RoutineD cache confirm the device was in North Carolina throughout April 5, 2020: ● Morning (9:00:54 AM UTC-4): Location recorded at latitude 35.6592, longitude -78.8728 (New Hill Rd, NC). ● Evening (8:26:05 PM UTC-4): Location recorded at latitude 35.6596, longitude -78.8727 (North Carolina). ● Analysis: These coordinates represent a "Home" or "Work" cluster in North Carolina. There are no travel-related artifacts (e.g., flight bookings in Mail or sudden time zone shifts) suggesting a move to California. CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL 4.2 COMMUNICATIONS WITH HICKMAN ● Search Results: A global search of SMS/iMessage, WhatsApp, and Call Logs returned zero hits for "Josh Hickman" on 4/5/2020. ● Active Comms: The device was used on this date for YouTube, WhatsApp (notifications only), and Gmail, but none of these interactions involved the individual in question. ● System Activity: The device saw heavy usage between 12:00 PM and 3:00 PM EST, primarily involving media consumption on YouTube and the Apple Clock app. 5 ETHICAL IMPLICATIONS 5.1 PRIVACY The report includes highly specific latitude/longitude data that identifies a private residence. This information is shared only within the context of legal proceedings. 5.2 INFORMED CONSENT The data extraction includes third-party metadata (contacts and group chat info) for individuals who did not consent to the search; investigators must ensure this data is not misused for unrelated inquiries. 6 CONCLUSIONS The comprehensive digital forensic investigation unequivocally establishes the subject device's physical location on April 5, 2020. Analysis of location data, network logs, and device metadata points conclusively to the device being in North Carolina throughout the requested timeframe. Crucially, the analysis yielded no forensic evidence, such as GPS coordinates, Wi-Fi connection logs, tower triangulation data, or communications metadata, that would support the assertion that the client was physically present in the state of California at any point during the timeframe under scrutiny. Furthermore, there is no recoverable digital evidence (e.g., text messages, email logs, call records, or instant messaging history) demonstrating communication between the client and the individual identified as Josh Hickman during the aforementioned period. The forensic data provides no basis to conclude that any interaction, digital or otherwise, occurred between these two parties as alleged. The digital footprint clearly anchors the device and, by reasonable inference, the client in North Carolina, negating claims of travel to or communication from California. CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL CSOL590 - Final Forensics Report DEWY, CHEETUM & HOWE CONFIDENTIAL ### References Apple. (2020). iOS Security Guide (Version 13.3.1). Apple Inc. Cellebrite. (2023). Cellebrite Reader (Version 7.60.0.27) [Computer software]. Cellebrite. Grammarly. (2026). Grammarly (Version 1.2.100) [Computer software]. https://www.grammarly.com The author used Grammarly to check for grammar, spelling, and punctuation errors during the final editing of this document. Magnet Forensics. (2020). Magnet AXIOM (Version 4.0) [Computer software]. Magnet Forensics. --- > **Archival Artifact:** The complete, formatted research publication can be accessed directly as a PDF at [https://codeandcypher.com/papers/csol590-presentation-of-findings.pdf](https://codeandcypher.com/papers/csol590-presentation-of-findings.pdf). --- ## Citation (APA 7th Edition) Wortz, J. A. (2026). *Forensic Investigation Findings: Incident Reconstruction, Root Cause, and Expert Witness Report*. Code and Cypher. https://doi.org/10.5281/zenodo.22287680