WIXLIB

Carrier-Specific Preservation RequestsRevForensics.com 5911 N Road 400 W, Bargersville IN 46106 317-527-1446

AT&T Civil Preservation Request10-11-2017RevForensics.com 5911 N Road 400 W, Bargersville IN 46106 317-527-1446

October 11, 2017AT&T MobilityNational Court Order Compliance11760 US Highway 1, Suite 600North Palm Beach, FL 33408-3029(800) 635-6840Fax (888) 938-4715Dear Sir or Ma’am,I am conducting an investigation and have identified the phone number 317-555-1212 as likely being pertinent tothis case. Per 18 USC § 2703, I am requesting AT&T Mobility preserve the records for the phone number 317-5551212, to include the following:1.2.3.4.5.6.7.Subscriber information for the number 317-555-1212 including by way of example and not limitation:a. Subscriber Nameb. Subscriber Addressc. Identifying information such as date of birth, driver’s license number, and/or social securitynumberd. Subscriber contact information including email addresses and contact phone numbersBilling and credit information for the phone number 317-555-1212 including by way of example andnot limitation:a. Method and source of payment information including credit card numbers, electronic fundstransfers, and locations of cash paymentsb. Credit information including any credit report run by the provider prior to the authorizing serviceService information for the phone number 317-555-1212 including by example and not limitation:a. Purchase and activation locationb. Types of service subscribed toc. Additional phone numbers associated with the same accountd. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associated with the accountCall Detail Records for the wireless number 317-555-1212 for the days of 06/01/2015 to 07/01/2015,Eastern Time, including:a. Cellular calls,b. SMS/MMS messagesc. Data communicationd. Tower locations (LAC/CID) and azimuth for the sectors accessed during the communicationAny data in the AT&T cloud services associated with the wireless number 317-555-1212, including byway of example and not limitationa. SMS, MMS,b. Emails communicationsLocation of the phone with the wireless number 317-555-1212 using Network Event Location System(NELOS) and Mobile Locator Tool data including reliability factors for the communication for thedays of 06/01/2015 to 07/01/2015, Eastern Time.Voice Mail Messages including contentRevForensics.com ben@revforensics.com 317-527-1446

8.A detailed definitions page which identifies all information in the recordsI will follow up with a court order or subpoena as needed. Thank you for your assistance.Sincerely,Benjamin BierceRevelation Cellular Forensics s.comRevForensics.com ben@revforensics.com 317-527-1446

Notes for Preparing the Legal Demand AT&T maintains records for the following periodso Cell sites for voice, text, and data back to July 2008o NELOS, about 30 dayso They do not store the content of text messages at allAT&T will supply the records with cell tower information from a subpoena, but a court order will result ina quicker turnaround.Be sure to request the records in digital format, specifically in .txt format, on a CD with the preparer’ssignature on it and a notarized copy of the Affidavit of Custodian of Records.AT&T provides digital records in PDF format by default, but will provide them in .txt format upon request.For analysis, I much prefer the .txt format.Request at least 30 days of records if you can justify it. A month of records is a large enough sample toestablish calling patterns to identify the most frequently called numbers. Get more if you can. The largerthe sample, the better the analysis.The following is the text I place in the notes of the fax coversheeto This is in reference case number xxx. Please provide the information in .txt format. Please emailthe records to me so I can begin working on them immediately. For court purposes, I need acertified copy as well. Please provide all the records along with the cell site locations in a singledisc, and have the custodian of records sign his or her name on the disc. Please complete theAffidavit of Custodian of Records and return the original copy with the records. The informationmay be mailed to:If you are having Revelation Cellular Forensics conduct the analysis you may want to include text like thefollowing:o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of theserecords. I respectfully request you allow Mr. Bierce to contact you directly with any questionsconcerning these records.RevForensics.com ben@revforensics.com 317-527-1446

Metro PCS Civil Preservation Request10-11-2017RevForensics.com 5911 N Road 400 W, Bargersville IN 46106 317-527-1446

October 11, 2017Metro PCS/T-Mobile, USALaw Enforcement Relations4 SylvanParsippany, NJ 07054(973) 292-8911Fax (973) 292-8697Dear Sir or Ma’am,I am conducting an investigation in a civil case and have identified the phone number 317-5551212 as likely being pertinent to this case. Per 18 USC § 2703, I am requesting Metro PCS/TMobile, USA preserve the records for the phone number 317-555-1212, to include the following:1. Subscriber information for the number 317-555-1212 including by way of example andnot limitation:a. Subscriber Nameb. Subscriber Addressc. Identifying information such as date of birth, driver’s license number, and/orsocial security numberd. Subscriber contact information including email addresses and contact phonenumbers2. Billing and credit information for the phone number 317-555-1212 including by way ofexample and not limitation:a. Method and source of payment information including credit card numbers,electronic funds transfers, and locations of cash paymentsb. Credit information including any credit report run by the provider prior to theauthorizing service3. Service information for the phone number 317-555-1212 including by example and notlimitation:a. Purchase and activation locationb. Types of service subscribed toc. Additional phone numbers associated with the same accountd. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associatedwith the accountRevForensics.com ben@revforensics.com 317-527-1446

4. Call Detail Records for the wireless number317-555-1212 for the days of 1/1/2015to2/1/2015, Eastern Time, including:a. Cellular calls,b. SMS/MMS messagesc. Data communicationd. Tower locations (LAC/CID) and azimuth for the sectors accessed during thecommunication5. A list of all T-Mobile cell towers with latitude, longitude, address, and sector directionsand beam widths6. Voice Mail Messages and Text Messages including content7. A detailed definitions page which identifies all information in the records8. Please provide records in Eastern TimeI will follow up with a search warrant as needed. Thank you for your assistance.Sincerely,Benjamin BierceRevelation Cellular Forensics s.comRevForensics.com ben@revforensics.com 317-527-1446

Notes for Preparing the Legal Demand Metro PCS/T-Mobile maintains records for the following periodso Cell sites for voice two yearso No cell sites for text messages or datao They do not store the content of text messages at allMetro PCS/T-Mobile requires a court order to produce the records.Be sure to request the records in digital format on a CD with the preparer’s signature on it and a notarizedcopy of the Affidavit of Custodian of Records.Metro PCS/T-Mobile provides the records in Microsoft Excel format.A spreadsheet containing all the T-Mobile cell sites is necessary for the analysis, and T-Mobile isinconsistent about sending them. Follow up contact may be necessary but no additional legal demandwould be needed.Request at least 30 days of records if you can justify it. A month of records is a large enough sample toestablish calling patterns to identify the most frequently called numbers. Get more if you can. The largerthe sample, the better the analysis.The following is the text I place in the notes of the fax coversheet:o This is in reference case number xxx. Please provide the information in digital format, either inMicrosoft Excel, or a format that could be exported to Excel. If you provide the information in aformat other than Excel please provide instructions to export to excel. Please email the records tome so I can begin working on them immediately. For court purposes I need a certified copy aswell. Please provide all the records along with the cell site locations in a single disc, and have thecustodian of records sign his or her name on the disc. Please complete the Affidavit of Custodianof Records and return the original copy with the records. The information may be mailed to:If you are having Revelation Cellular Forensics conduct the analysis you may want to include text like thefollowing:o Benjamin Bierce of Revelation Cellular Forensics, LLC will be conducting the analysis of theserecords. I respectfully request you allow Mr. Bierce to contact you directly with any questionsconcerning these records.RevForensics.com ben@revforensics.com 317-527-1446

Sprint Civil Preservation Request10-11-2017RevForensics.com 5911 N Road 400 W, Bargersville IN 46106 317-527-1446

February 1, 2014Sprint CorporationSecurity & Subpoena Compliance6480 Sprint ParkwayMS: KSOPHM0216Overland Park, KS 66251(800) 877-7330Fax (816) 600-3111Dear Sir or Ma’am,I am conducting an investigation and have identified the phone number 317-555-1212 as likelybeing pertinent to this case. Per 18 USC § 2703, I am requesting Sprint Corporation preserve therecords for the phone number 317-555-1212, to include the following:1. Subscriber information (Expanded) for the number 317-555-1212 including by wayof example and not limitation:a. Subscriber Nameb. Subscriber Addressc. Identifying information such as date of birth, driver’s license number, and/orsocial security numberd. Subscriber contact information including email addresses and contact phonenumbers2. Billing and credit information (Payment Information) for the phone number 317-5551212 including by way of example and not limitation:a. Method and source of payment information including credit card numbers,electronic funds transfers, and locations of cash paymentsb. Credit information including any credit report run by the provider prior to theauthorizing service3. Service information for the phone number 317-555-1212 including by example andnot limitation:a. Purchase and activation locationb. Types of service subscribed toc. Additional phone numbers associated with the same accountd. Make, model, and serial numbers (ESN, IMEI, MEID) of the phone(s) associatedwith the accountRevForensics.com ben@revforensics.com 317-527-1446

4. Call Detail Records for the wireless number 317-555-1212 for the days of 07/01/2015to 08/01/2015, Eastern Time, including by example and not limitation:a. Cellular calls (Call Detail Records with Cell Site Location)b. SMS/MMS messagesc. Data communication (IPDR w/ Cell Site, Web Site Address Report)d. Tower locations (NEID, Cell Number, Sector Number, eNode) and azimuth forthe sectors accessed during the communication5. Voice Mail Messages including content (Stored Voice Mail Reproduction)6. PCMD (Per Call Measurement Data) for the cellular phone number 317-555-1212 forthe days of 07/01/2015 to 08/01/2015, Eastern Time, to include reliability factors forthe communication7. A detailed definitions page which identifies all information in the recordsI will follow up with a court order or subpoena as needed. Thank you for your assistance.Sincerely,Benjamin BierceRevelation Cellular Forensics s.comRevForensics.com ben@revforensics.com 317-527-1446