EFTA01621371.pdf

<?xml version="1.0" encoding="utf-8"?> <project id="84f8c21d-ca33-4024-9583-c63c9980c05a" name="Apple iPad_2019-09-05_Report" reportVersion =65.6.1" containsGarbage="False" extractionType="Legacy" NodeCount="0" ModelCount="22" xmlns="http:/ /pa.cellebrite.com/report/2.0"› <sourceExtractions> <extractionInfo id="0" name="Legacy" isCustomName="False" type="Legacy" deviceName="IPAD" fullNa me="Apple iPad" index="0" IsPartialData="False" I> </sourceExtractions> <caselnformation> <field name="Examiner name" isSystem="True" isRequired="True" fieldType="ExaminerName" multipleL ines="False">Stephen R Flatley</field> <field name="Location" isSystem="True" isRequired="False" fieldType="Location" multipleLines="Fa lse">26 Federal Plaza CART Lab</field> <field name="Case number" isSystem="True" isRequired="False" fieldType="CaseNumber" multipleLine s="False">31E-NY-3027571</field> <field name="Case name" isSystem="True" isRequired="False" fieldType="CaseName" multipleLines="F alse">Jeffrey Epstein</field> <field name="Evidence number" isSystem="True" isRequired="False" fieldType="EvidenceNumber" mult ipleLines="False">NYCO24357</field> <field name="Department" isSystem="True" isRequired="False" fieldType="Department" multipleLines ="False">FBI NY CART</field> <field name="Investigator" isSystem="True" isRequired="False" fieldType="Investigator" multipleL ines="False">Stephen R Flatley</field> </caselnformation> <metadata section="Additional Fields"› <item name="DevicelnfoCreationTime" systemtype="System.String"><!(CDATA[05/11/2020 15:54:05]1></ item> <item name="UFED_PA_Version" systemtype="System.String"><!(CDATA[7.24.0.209]]></item> <item name="UfdrLanguage" systemtype="System.String"><![CDATA(en]]></item> </metadata> <metadata section="Extraction Data"> <item name="DeviceInfoSelectedManufacturer" sourceExtraction="0" systemtype="System.String"><!(C DATA[Apple)]></item> <item name="DevicelnfOSelectedDeviceName" sourceExtraction="0" systemtype="System.String"><!(CDA TA(IPAD]]></item> </metadata> <images I> <HashSetslnfo <MalwareScanner ScanPerformed="False" <taggedFiles I> <decodedData> <modelType type="Contact"> <model type="Contact" id="b0b25941-7f1c-4aad-aba3-671ff319d66e" deleted_state="Intact" decodin g_confidence="High" isrelated="False" source_index="162" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False)]></value> </field> <field name="Source" type="String"> <empty I> </field> <field name="Name" type="String"> <value type="String"><!(CDATA[JEE Guest]]></value> </field> <multiModelField name="Photos" type="ContactPhoto" <multiModelField name="Entries" type="ContactEntry"> <model type="EmailAddress" id="d9633483-4322-4392-9a01-a38adefle66a° deleted_state="Intact " decoding_confidence="High" isrelated="False" source_index="163" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String"> <empty />. </field> <field name="Category" type="String"> <value type="String"><![CDATA(General]]></value> </field> <field name="Value" type="String"> <value type="String"><![CDATA(jee.guest.appletv9gmail.com])></value> </field> <field name="Domain" type="String"> <value type="String"><![CDATA(Email]]></value> </field> </model> </multiModelField> <multiField name="Notes" type="String" <multiModelField name="Addresses" type="StreetAddress" /> <multiModelField name="Organizations" type="Organization" I> <field name="Group" type="String"> <empty I> EFTA01621371  </field> <field name="Type" type="ContactType"> <empty I> </field> <field name="TimeContacted" type="TimeStampa> <empty I> </field> <field name="TimeCreated" type="TimeStamp"> <value type="TimeStamp" format="TimeStampAnown">2018-09-06T22:25:31.000-04:00</value> </field> <field name="TimeModified" type="TimeStamp"> <value type="TimeStamp" format="TimeStampAnown">2018-09-06T22:25:31.000-04:00</value> </field> <field name="TimesContacted" type="Int32"> <empty I> </field> <jumptargets name=""> <targetid ismodel="true"><![CDATA(f769a32f-9del-4431-15026-e235f8d04577)]></targetid> </jumptargets> </model> </modelType> <modelType type="Locationn> <model type="Location" id="645837e9-e2ac-4338-9f8f-50da6735201d" deleted_state="Intact" decodi ng_confidence="High" isrelated="False" source_index="551" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False)]></value> </field> <field name="Source" type="Stringw> <empty I> </field> <modelField name="Position" type="Coordinate"› <empty /> </modelField> <field name="PositionAddress" type="String"> <empty I> </field> <modelField name="Address" type="StreetAddress"> <empty I> </modelField> <field name="TimeStamp" type="TimeStamp"› <value type="TimeStamp" format="TimeStampAnown">2018-10-11T14:05:04.456-04:00</value> </field> <field name="Name" type="String"> <value type="String"><!(CDATA[NESSLLC))></value> </field> <field name="Description" type="Stringw> <value type="String"><!(CDATA[BSSID: f0:9f:c2:3a:78:31 SSID: NESSLLC]1></value> </field> <field name="Type" type="String"> <value type="String"><!(CDATA[Wireless Network ])></value> </field> <field name="Precision" type="String"> <empty I> </field> <field name="Confidence" type="Int32"› <empty I> </field> <field name="Map" type="Stringm> <empty I> </field> <field name="Category" type="String.> <value type="String"><!(CDATA[Wireless Networks])></value> </field> <field name="Origin" type="LocationOriginw> <empty /> </field> <field name="EndTime" type="TimeStamp"› <empty /> </field> <field name="AggregatedLocationsCount" type="Int32"> <empty /> </field> <jumptargets name=""> <targetid ismodel="true"><![CDATA(0945d2f0-f29f-4161-bb38-03c4958d161d]]></targetid> </jumptargets> </model> <model type="Location" id="55a59712-3677-414f-b090-26a81e5aa325" deleted_state="Intact" decodi ng_confidence="High" isrelated="False" source_index="552" extractionld="0"> <field name="UserMapping" type="Boolean"> EFTA01621372  <value type="Boolean"><!(CDATA[False)]></value> </field> <field name="Source" type="Stringw> <empty I> </field> <modelField name="Position" type="Coordinate"› <empty I> </modelField> <field name="PositionAddress" type="String.> <empty I> </field> <modelField name="Address" type="StreetAddress"> <empty I> </modelField> <field name="TimeStamp" type="TimeStamp"› <value type="TimeStamp" format="TimeStampAnown">2017-09-21T09:48:25.739-04:00</value> </field> <field name="Name" type="String"› <value type="String"><!(CDATA[NESSLLC])></value> </field> <field name="Description" type="Stringn> <value type="String"><!(CDATA[BSSID: f0:9f:c2:3a:78:31 SSID: NESSLLC]]></value> </field> <field name="Type" type="String"> <value type="String"><!(CDATA[Wireless Network Last Connection)]></value> </field> <field name="Precision" type="String"> <empty I> </field> <field name="Confidence" type="Int32"› <empty I> </field> <field name="Map" type="String"> <empty I> </field> <field name="Category" type="String.> <value type="String"><!(CDATA[Wireless Networks])></value> </field> <field name="Origin" type="LocationOrigina> <empty I> </field> <field name="EndTime" type="TimeStamp.> <empty I> </field> <field name="AggregatedLocationsCount" type="Int32"› <empty I> </field> <jumptargets name=""> <targetid ismodel="true"><![CDATA(39be4e42-78fa-4b86-a8cf-73f860dab023)]></targetid> </jumptargets> </model> <model type="Location" id="929d4e49-d33c-4ada-b410-d8822d4105d4" deleted_state="Deleted" decod ing_confidence="High" isrelated="False" source_index="553" extractionId="0"› <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False)]></value> </field> <field name="Source" type="Stringw> <empty I> </field> <modelField name="Position" type="Coordinate"› <model type="Coordinate" id="7ada29c4-e4a7-4773-aa32-5f2d3deb688f" deleted_state="Unknown" decoding_confidence="High" isrelated="False" source_index="554" extractionId="0"› <field name="UserMapping" type="Booleana> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String.> <empty /> </field> <field name="Longitude" type="Double"> <empty /> </field> <field name="Latitude" type="Double"> <empty I> </field> <field name="Elevation" type="Doublen> <empty /> </field> <field name="Comment" type="Stringw> <empty I> EFTA01621373  </field> <field name="PositionAddress" type="String"› <empty I> </field> <field name="Map" type="String"> <empty /> </field> </model> </modelField> <field name="PositionAddress" type="String"> <empty I> </field> <modelField name="Address" type="StreetAddress"> <empty I> </modelField> <field name="TimeStamp" type="TimeStamp"› <empty I> </field> <field name="Name" type="String"> <empty I> </field> <field name="Description" type="Stringw> <empty I> </field> <field name="Type" type="String"> <empty I> </field> <field name="Precision" type="String"› <empty I> </field> <field name="Confidence" type="Int326> <empty /> </field> <field name="Map" type="String.> <empty I> </field> <field name="Category" type="Stringm> <value type="String"><!(CDATA[iOSLocations])></value> </field> <field name="Origin" type="LocationOrigina> <empty I> </field> <field name="EndTime" type="TimeStamp.> <empty I> </field> <field name="AggregatedLocationsCount" type="Int32"› <empty I> </field> </model> </modelType> <modelType type="UserAccounta> <model type="UserAccount" id="773fae5f-962d-4858-b272-386e152e64cf" deleted_state="Intact" dec oding_confidence="High" isrelated="False" source_index="555" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False)]></value> </field> <field name="Source" type="Stringw> <empty I> </field> <field name="Name" type="String"> <empty I> </field> <field name="Username" type="String.> <value type="String"><!(CDATA[[email protected]]]></value> </field> <field name="Password" type="String.> <empty I> </field> <field name="ServiceType" type="Stringw> <value type=mString"><!(CDATA[FFFF4CDC-923F-47D6-9C8B-OED1703A6E3B])></value> </field> <field name="ServerAddress" type=°Stringm> <empty I> </field> <multiModelField name="Photos" type="ContactPhoto" /> <multiModelField name="Entries" type="ContactEntryn> <model type="ContactEntry" id="gee2d41f-5972-4f10-8306-1a46f1c1c4d6" deleted_state="Intact decoding_confidence="High" isrelated="False" source_index="556" extractionld="D"> <field name="UserMapping" type="Booleana> EFTA01621374  <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String.> <empty /> </field> <field name="Category" type="String"> <value type="String"><![CDATA(Account Description]]></value> </field> <field name="Value" type="String"> <value type="String"><![CDATA(iTunes Store]]></value> </field> <field name="Domain" type="String"> <empty I> </field> </model> </multiModelField> <multiField name="Notes" type="String" I> <multiModelField name="Addresses" type="StreetAddress" I> <multiModelField name="Organizations" type="Organization" /> <field name="TimeCreated" type="TimeStampa> <value type="TimeStamp" format="TimeStampAnown">2017-09-21T09:55:23.103-04:00</value> </field> </model> <model type="UserAccount" id="15c4c1a1-7417-4f13-a0a4-cbeea9181544a" deleted_state="Intact" dec oding_confidence="High" isrelated="False" source_index="557" extractionId="0"› <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False)]></value> </field> <field name="Source" type="Stringw> <empty /> </field> <field name="Name" type="String"> <empty I> </field> <field name="Username" type="String.> <value type="String"><!(CDATA[[email protected]]]></value> </field> <field name="Password" type="String.> <empty I> </field> <field name="ServiceType" type="Stringw> <value type="String"><!(CDATA[DB224DB5-37F4-4EEF-PEC1-BBC911DC37F3]]></value> </field> <field name="ServerAddress" type="String"› <empty I> </field> <multiModelField name="Photos" type="ContactPhoto" I> <multiModelField name="Entries" type="ContactEntry"> <model type="ContactEntry" id="ad4b5a5b-7078-4eal-b897-c0a3baac4866" deleted_state="Intact decoding_confidence="High" isrelated="False" source_index="558" extractionId="0"› <field name="UserMapping" type="Booleana> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String.> <empty I> </field> <field name="Category" type="String"> <value type="String"><![CDATA(Account Description]]></value> </field> <field name="Value" type="String"› <value type="String"><![CDATA(Messages]]></value> </field> <field name="Domain" type="String.> <empty /> </field> </model> </multiModelField> <multiField name="Notes" type="String" /> <multiModelField name="Addresses" type="StreetAddress" I> <multiModelField name="Organizations" type="Organization" I> <field name="TimeCreated" type="TimeStampa> <value type="TimeStamp" format="TimeStampAnown">2017-09-21T09:55:23.143-04:00</value> </field> </model> <model type="UserAccount" id="7915d806-e943-4dah-Sd05-60a08a72418c° deleted_state="Intact" dec oding_confidence="High" isrelated="False" source_indez="559" extractionId="0"› <field name="UserMapping" type="Boolean"› <value type="Boolean"><!(CDATA(False)]></value> </field> EFTA01621375  <field name="Source" type="Stringw> <empty I> </field> <field name="Name" type="String"> <empty I> </field> <field name="Username" type="String"› <value type="String"><!(CDATA[[email protected]]]></value> </field> <field name="Password" type="String"› <empty /> </field> <field name="ServiceType" type="Stringw> <value type="String"><!(CDATA[E3ES3C34-5D8E-4F2D-82D5-3A9657F930D4])></value> </field> <field name="ServerAddress" type="Stringn> <empty I> </field> <multiModelField name="Photos" type="ContactPhoto" I> <multiModelField name="Entries" type="ContactEntry"> <model type="ContactEntry" id="dd123a6b-b2a2-4a39-85f8-8161139fb02d" deleted_state="Intact decoding_confidence="High" isrelated="False" sourceindex="560" extractionId="0"› <field name="UserMapping" type="Booleana> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String"> <empty I> </field> <field name="Category" type="String"> <value type="String"><![CDATA(Account Description]]></value> </field> <field name="Value" type="String"> <value type="String"><![CDATA(Game Center]]></value> </field> <field name="Domain" type="String.> <empty I> </field> </model> </multiModelField> <multiField name="Notes" type="String" I> <multiModelField name="Addresses" type="StreetAddress" I> <multiModelField name="Organizations" type="Organization" I> <field name="TimeCreated" type="TimeStampa> <value type="TimeStamp" format="TimeStampKnown">2017-09-21T09:55:23.533-04:00</value> </field> </model> <model type="UserAccount" id="00a2d4fe-7c0d-4da2-8342-63e623277b135" deleted_state="Intact" dec oding_confidence="High" isrelated="False" source_index="561" extractionId="0"› <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="Stringn> <empty I> </field> <field name="Name" type="String"> <empty I> </field> <field name="Username" type="Stringm> <value type="String"><!(CDATA[[email protected]))></value> </field> <field name="Password" type="String.> <empty I> </field> <field name="ServiceType" type="Stringw> <value type="String"><!(CDATA[4624363D-CA17-466B-9286-FE19A36BFE73])></value> </field> <field name="ServerAddress" type="Stringn> <empty I> </field> <multiModelField name="Photos" type="ContactPhoto" I> <multiModelField name="Entries" type="ContactEntry"> <model type="ContactEntry" id="1725e0db-9d8c-4497-a6cb-cdfdld5ef5fd" deleted_state="Intact decoding_confidence="High" isrelated="False" source_index="562" extractionId="0"› <field name="UserMapping" type="Booleana> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String.> <empty I> </field> EFTA01621376  <field name="Category" type="String"> <value type="String"><![CDATA(Account Description]]></value> </field> <field name="Value" type="String"> <value type="String"><![CDATA(Device Locatorl]></value> </field> <field name="Domain" type="String.> <empty I> </field> </model> </multiModelField> <multiField name="Notes" type="String" I> <multiModelField name="Addresses" type="StreetAddress" I> <multiModelField name="Organizations" type="Organization" I> <field name="TimeCreated" type="TimeStampa> <value type="TimeStamp" format="TimeStampKnown">2017-09-21T09:55:26.248-04:00</value> </field> </model> <model type="UserAccount" id="411057c1-7ffc-4136-Se60-beS0e69f4491," deleted_state="Intact" dec oding_confidence="High" isrelated="False" source_index="563" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False))></value> </field> <field name="Source" type="Stringw> <empty I> </field> <field name="Name" type="String"> <empty I> </field> <field name="Username" type="String"› <value type="String"><!(CDATA[[email protected]]]></value> </field> <field name="Password" type="String"› <empty I> </field> <field name="ServiceType" type="String"> <value type="String"><!(CDATA[80115E06-184F-4726-A269-867216C2D498] 1></valze-, </field> <field name="ServerAddress" type="Stringw> <empty I> </field> <multiModelField name="Photos" type="ContactPhoto" I> <multiModelField name="Entries" type="ContactEntry"> <model type="ContactEntry" id="8f1131a8-83ae-4574-a306-05565e8791ef" deleted_state="Intact decoding_confidence="High" isrelated="False" source_index="564" extractionld="D"> <field name="UserMapping" type="Booleana> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String.> <empty I> </field> <field name="Category" type="String"> <value type="String"><![CDATA(Account Description]]></value> </field> <field name="Value" type="String"> <value type="String"><![CDATA(CloudKit])></value> </field> <field name="Domain" type="Stringm> <empty I> </field> </model> </multiModelField> <multiField name="Notes" type="String" I> <multiModelField name="Addresses" type="StreetAddress" I> <multiModelField name="Organizations" type="Organization" I> <field name="TimeCreated" type="TimeStampa> <value type="TimeStamp" format="TimeStampKnown">2017-09-21T09:55:27.683-04:00</value> </field> </model> <model type="UserAccount" id="36e68785-f726-4dcf-9daf-92f663fbd799" deleted_state="Intact" dec oding_confidence="High" isrelated="False" source_index="565" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><![CDATA[Falsej]></value> </field> <field name="Source" type="Stringw> <empty I> </field> <field name="Name" type="String"> <empty I> EFTA01621377  </field> <field name="Username" type="Strings> <value type="String"><!(CDATA[[email protected]]]></value> </field> <field name="Password" type="Stringm> <empty I> </field> <field name="ServiceType" type="Stringw> <value type="String"><!(CDATA[72941E3C-4CE3-4DAE-A55B-231ASFB43D5D])></value> </field> <field name="ServerAddress" type="Strine> <empty I> </field> <multiModelField name="Photos" type="ContactPhoto" I> <multiModelField name="Entries" type="ContactEntryn> <model type="ContactEntry" id="1c2f36dc-7c32-400b-aff3-Ted05446a9d2" deleted_state="Intact decoding_confidence="High" isrelated="False" source_index="566" extractionld="0"> <field name="UserMappine type="Booleana> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String.> <empty I> </field> <field name="Category" type="String"> <value type="String"><![CDATA(Account Description]]></value> </field> <field name="Value" type="String"> <value type="String"><![CDATA(iCloud]]></value> </field> <field name="Domain" type="Stringm> <empty I> </field> </model> </multiModelField> <multiField name="Notes" type="String" I> <multiModelField name="Addresses" type="StreetAddress" I> <multiModelField name="Organizations" type="Organization" I> <field name="TimeCreated" type="TimeStampa> <value type="TimeStamp" format="TimeStampAnown">2017-09-21T09:55:27.684-04:00</value> </field> </model> <model type="UserAccount" id="2c85e10d-32de-4dc5-24872-alS7cfa3ca95" deleted_state="Intact" dec oding_confidence="High" isrelated="False" source_index="567" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False])></value> </field> <field name="Source" type="Strine> <empty /> </field> <field name="Name" type="String"> <empty I> </field> <field name="Username" type="String.> <value type="String"><!(CDATA[[email protected]])></value> </field> <field name="Password" type="String.> <empty I> </field> <field name="ServiceType" type="Stringw> <value type="String"><!(CDATA[8E699D65-EEBA-4C1C-BD25-A64551332330])></value> </field> <field name="ServerAddress" type="Strine> <empty I> </field> <multiModelField name="Photos" type="ContactPhoto" I> <multiModelField name="Entries" type="ContactEntryn> <model type="ContactEntry" id="afO571ef-feb9-4dcO-8Ofe-ef763135Sca9O" deleted_state="Intact decoding_confidence="High" isrelated="False" source_index="568" extractionld="0"> <field name="UserMappine type="Booleana> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String.> <empty I> </field> <field name="Category" type="String"> <value type="String"><![CDATA(Account Description]]></value> </field> <field name="Value" type="String"> <value type="String"><![CDATA(Find My Friends))></value> EFTA01621378  </field> <field name="Domain" type="String.> <empty I> </field> </model> </multiModelField> <multiField name="Notes" type="String" I> <multiModelField name="Addresses" type="StreetAddress" I> <multiModelField name="Organizations" type="Organization" I> <field name="TimeCreated" type="TimeStamp"> <value type="TimeStamp" format="TimeStampKnown">2017-09-21T09:55:26.266-04:00</value> </field> </model> <model type="UserAccount" id="3a2e630a-2a5f-4c3c-af62-274ecl8f6ad2" deleted_state="Intact" dec oding_confidence="High" isrelated="False" source_index="569" extractionId="0"› <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[Falsej)></value> </field> <field name="Source" type="Stringw> <empty I> </field> <field name="Name" type="String"> <empty I> </field> <field name="Username" type="String.> <value type="String"><!(CDATA[jee.guest.appletv6gmail.com]]></value> </field> <field name="Password" type="String.> <empty I> </field> <field name="ServiceType" type="Stringw> <value type="String"><!(CDATA[99AFB545-D97B-4875-9102-4097A7EA7F69])></value> </field> <field name="ServerAddress" type="Stringw> <empty I> </field> <multiModelField name="Photos" type="ContactPhoto" I> <multiModelField name="Entries" type="ContactEntryn> <model type="ContactEntry" id="4731611e-fOlf-45b3-866d-a198af98b9d8" deleted_state="Intact decoding_confidence="High" isrelated="False" source_index="570" extractionId="0"› <field name="UserMapping" type="Booleana> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="String.> <empty I> </field> <field name="Category" type="String"> <value type="String"><![CDATA(Account Description]]></value> </field> <field name="Value" type="String"> <value type="String"><![CDATA[IDMS)]></value> </field> <field name="Domain" type="String.> <empty I> </field> </model> </multiModelField> <multiField name="Notes" type="String" I> <multiModelField name="Addresses" type="StreetAddress" I> <multiModelField name="Organizations" type="Organization" I> <field name="TimeCreated" type="TimeStampa> <value type="TimeStamp" format="TimeStampKnown">2017-09-21T09:55:28.202-04:00</value> </field> </model> <model type="UserAccount" id="f134dc89-7841-4a18-bab7-667db52b162b" deleted_state="Intact" dec oding_confidence="High" isrelated="False" source_index="571" extractionId="0"› <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False))></value> </field> <field name="Source" type="Stringw> <empty I> </field> <field name="Name" type="String"> <empty I> </field> <field name="Username" type="String.> <value type="String"><!(CDATA[[email protected]])></value> </field> <field name="Password" type="String.> EFTA01621379  <empty /> </field> <field name="ServiceType" type="String•> <value type="String"><!(CDATA[CCDA96B3-BB78-472D-80FE-DEOEEESCC787])></value> </field> <field name="ServerAddress• type=•String•> <empty I> </field> <multiModelField name="Photos" type="ContactPhoto" I> <multiModelField name="Entries" type="ContactEntry•> <model type=•ContactEntry" id="290c70fc-3d7f-45a8-a33e-10ee238627ff• deleted_state="Intact decoding_confidence="High" isrelated="False" source_index=•572" extractionld="0"> <field name=•UserMapping• type="Booleann> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name=•Source" type="String.> <empty I> </field> <field name=•Category" type="String"> <value type="String"><![CDATA(Account Description]]></value> </field> <field name=•Value" type="String"> <value type="String"><![CDATA(Apple ID))></value> </field> <field name=•Domain" type="String.> <empty I> </field> </model> </multiModelField> <multiField name="Notes" type="String" I> <multiModelField name="Addresses" type="StreetAddress" I> <multiModelField name="Organizations" type="Organization" I> <field name="TimeCreated" type="TimeStampa> <value type=•TimeStamp" format=•TimeStampKnown">2017-09-21709:55:28.345-04:00</value> </field> </model> </modelType> <modelType type="DictionaryWord"› <model type="DictionaryWord" id="a62fbece-lcad-44b6-ad00-21e34c3907a4" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index=•573" extractionld=•0"> <field name="UserMapping" type="Boolean"> <value type=•Boolean"><!(CDATA[Falsej]></value> </field> <field name="Source" type=•String•> <empty /> </field> <field name="Word" type="String"> <value type=•String"><!(CDATA[exacq]J></value> </field> <field name="Locale" type=•String•> <value type=•String•><!(CDATA[ histogram))></value> </field> <field name="Frequency" type="Int32"> <value type=•Int32"><![CDATA(1]]></value> </field> </model> <model type="DictionaryWord" id="297641b9-f2d2-4d96-b9f2-1d2328321ab7" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index=•574" extractionld=•0"> <field name="UserMapping" type="Boolean"> <value type=•Boolean"><![CDATA[Falsel]></value> </field> <field name="Source" type=•String•> <empty I> </field> <field name="Word" type="String"> <value type=•String"><!(CDATA[jepstein]]></value> </field> <field name="Locale" type=•String•> <value type=•String•><!(CDATA[ histogram])></value> </field> <field name="Frequency" type="Int32"> <value type=•Int32"><![CDATA(2]]></value> </field> </model> <model type="DictionaryWord" id="87ac1b2a-6931-41a9-bade-34dfc0a30868" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index=•575" extractionld=•0"> <field name="UserMapping" type="Boolean"> <value type=•Boolean"><![CDATA[Falsel]></value> </field> EFTA01621380  <field name="Source" type="Stringn> <empty I> </field> <field name="Word" type="String"> <value type="String"><!(CDATA[11c]]></value> </field> <field name="Locale" type="Stringn> <value type="String"><!(CDATA[ histogram]]></value> </field> <field name="Frequency" type="Int32.> <value type="Int32"><![CDATA(1]]></value> </field> </model> <model type="DictionaryWord" id="3cc35cc1-6098-4616-9e4f-bbc1b75dc04d" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="576" extractionId="0"› <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="Stringw> <empty I> </field> <field name="Word" type="String"> <value type="String"><!(CDATA[nesIlc]]></value> </field> <field name="Locale" type="String"› <value type="String"><!(CDATA[ histogram]]></value> </field> <field name="Frequency" type="Int32.> <value type="Int32"><![CDATA(3]]></value> </field> </model> <model type="DictionaryWord" id="19a63dc9-a4b3-41b3-a539-71fe8c3a860e" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="577" extractionId="0"› <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="Strine> <empty I> </field> <field name="Word" type="String"> <value type="String"><!(CDATA[nes]]></value> </field> <field name="Locale" type="String"› <value type="String"><!(CDATA[ histogram]]></value> </field> <field name="Frequency" type="Int32.> <value type="Int32"><![CDATA(1]]></value> </field> </model> </modelType> <modelType type="WirelessNetworkw> <model type="WirelessNetwork" id="0945d2f0-f29f-41b1-bb38-03c4958d161d" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="578" extractionId="0"› <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False]]></value> </field> <field name="Source" type="Strine> <empty I> </field> <field name="BSSId" type="String"› <value type="String"><!(CDATA[f0:9f:c2:3a:78:31])></value> </field> <field name="SSId" type="String"> <value type="String"><!(CDATA[NESSLLC])></value> </field> <field name="SecurityMode" type="String"> <value type="String"><!(CDATA[WPA2 Fersonal]]></value> </field> <modelField name="Fosition" type="Coordinate"› <empty I> </modelField> <field name="FositionAddress" type="String"> <empty I> </field> <field name="LastConnection" type="TimeStamp"> <empty I> </field> <field name="LastAutoConnection" type="TimeStamp"> <empty I> EFTA01621381  </field> <field name="TimeStamp" type="TimeStamp"› <value type="TimeStamp" format="TimeStampKnown">2018-10-11T14:05:04.456-04:00</value> </field> <field name="Package" type="String"> <empty I> </field> <field name="EndTime" type="TimeStamp"› <empty I> </field> <jumptargets name=""> <targetid ismodel="true"><![CDATA(645837e9-e2ac-4338-9f8f-50da6735201d]]></targetid> </jumptargets> </model> <model type="WirelessNetwork" id="39be4e42-78fa-4686-a8cf-73f860dab023" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="579" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False))></value> </field> <field name="Source" type="Stringw> <empty I> </field> <field name="BSSId" type="String"› <value type="String"><!(CDATA[f0:9f:c2:3a:78:31])></value> </field> <field name="SSId" type="String"> <value type="String"><!(CDATA[NESSLLC])></value> </field> <field name="SecurityMode" type="String"> <value type="String"><!(CDATA[WPA2 Personal))></value> </field> <modelField name="Position" type="Coordinate"› <empty I> </modelField> <field name="PositionAddress" type="String"› <empty I> </field> <field name="LastConnection" type="TimeStamp"› <value type="TimeStamp" format="TimeStampAnown">2017-09-21T09:48:25.739-04:00<ivalue> </field> <field name="LastAutoConnection" type="TimeStamp"› <value type="TimeStamp" format="TimeStampKnown">2018-10-11T14:05:04.456-04:00</value> </field> <field name="TimeStamp" type="TimeStamp"› <empty I> </field> <field name="Package" type="String"> <empty I> </field> <field name="EndTime" type="TimeStamp"› <empty /> </field> <jumptargets name=""> <targetid ismodel="true"><![CDATA(55a59712-3677-414f-b090-26a81e5aa325]]></targetid> </jumptargets> </model> <model type="WirelessNetwork" id="0543c5eb-04bf-4599-b180-c35f1d729629" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="580" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[Falsej]>Givalue> </field> <field name="Source" type="Stringw> <empty I> </field> <field name="BSSId" type="String"› <empty I> </field> <field name="SSId" type="String"> <value type="String"><!(CDATA[Apple Demo]]></value> </field> <field name="SecurityMode" type="String"› <empty />. </field> <modelField name="Position" type="Coordinate"› <empty I> </modelField> <field name="PositionAddress" type="String.> <empty I> </field> EFTA01621382  <field name="LastConnection" type="TimeStamp"› <empty I> </field> <field name="LastAutoConnection" type="TimeStampa> <empty I> </field> <field name="TimeStamp" type="TimeStamp"› <empty I> </field> <field name="Package" type="String"> <empty I> </field> <field name="EndTime" type="TimeStamp"› <empty I> </field> </model> <model type="WirelessNetwork" id="a64f22d4-b7c6-4a5d-b702-418daeO176c3" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="581" extractionld="0"> <field name="UserMapping" type="Boolean"> <value type="Boolean"><!(CDATA[False)]></value> </field> <field name="Source" type="Stringw> <empty I> </field> <field name="BSSId" type="String"› <empty I> </field> <field name="SSId" type="String"› <value type="String"><!(CDATA[Apple Store]]></value> </field> <field name="SecurityMode" type="String"> <empty I> </field> <modelField name="Position" type="Coordinate"› <empty I> </modelField> <field name="PositionAddress" type="String"› <empty I> </field> <field name="LastConnection" type="TimeStamp"› <empty I> </field> <field name="LastAutoConnection" type="TimeStampa> <empty I> </field> <field name="TimeStamp" type="TimeStamp"› <empty I> </field> <field name="Package" type="String"> <empty I> </field> <field name="EndTime" type="TimeStamp"› <empty I> </field> </model> </modelType> </decodedData> <carvedFiles I> <infectedFiles I> <entityBookmarks> <entityBookmark name="" id="eaaef690-6358-4eb2-9a7f-ffadd8808a5e" type="EntityBookmark"> <field name="BookmarkId" type="Int32"› <value type="Int32"><![CDATA(1]]></value> </field> <field name="Index" type="Int326> <value type="Int32"><![CDATA(01]></value> </field> <field name="EntityTypeName" type="String"> <value type="String"><!(CDATA[Contacts)]></value> </field> <field name="EntityGuid" type="Guidn> <value type="Guid"><!(CDATA[b0b25941-7f1c-4aad-aba3-671f£319d66ej]></value> </field> <field name="Description" type="String"> <empty I> </field> <field name="CreationDate" type="TimeStamp"› <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:57:51.140</value> </field> EFTA01621383  <field name="LastModifiedDate" type="TimeStamp"› <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:57:51.140</value> </field> <multiField name="Tags" type="String"> <value type="String"><!(CDATA[Responsive])></value> </multiField> </entityBookmark> <entityBookmark name="" id="3cald363-8354-4ebf-a5e5-55453ceBb603" type="EntityBookmark"> <field name="BookmarkId" type="Int32"› <value type="Int32"><![CDATA(2])></value> </field> <field name="Index" type="Int32"› <value type="Int32"><![CDATA(0])></value> </field> <field name="EntityTypeName" type="String"> <value type="String"><!(CDATA[Locations])></value> </field> <field name="EntityGuid" type="Guidn> <value type="Guid"><!(CDATA[b45837e9-e2ac-4338-9f8f-50da6735201d])></value> </field> <field name="Description" type="String"> <empty I> </field> <field name="CreationDate" type="TimeStamp"› <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:25.594</value> </field> <field name="LastModifiedDate" type="TimeStamp"› <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:27.010</value> </field> <multiField name="Tags" type="String"> <value type="String"><!(CDATA[Responsive])></value> </multiField> </entityBookmark> <entityBookmark name="" id="43176217-af6e-47d5-8335-822202d283c4" type="EntityBookmark"> <field name="BookmarkId" type="Int32"› <value type="Int32"><![CDATA(31]></value> </field> <field name="Index" type="Int32"> <value type="Int32"><![CDATA(01]></value> </field> <field name="EntityTypeName" type="String"> <value type="String"><![CDATA[Locations]]></value> </field> <field name="EntityGuid" type="Guidn> <value type="Guid"><!(CDATA[55a59712-3677-414f-b090-26aBle5aa325])></value> </field> <field name="Description" type="String"> <empty /> </field> <field name="CreationDate" type="TimeStampw> <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:25.594</value> </field> <field name="LastModifiedDate" type="TimeStamp"› <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:27.010</value> </field> <multiField name="Tags" type="String"› <value type="String"><!(CDATA[Responsive])></value> </multiField> </entityBookmark> <entityBookmark name="" id="a79e1481-5f5a-4fd8-8c61-74d2ff9c642b" type="EntityBookmark"> <field name="BookmarkId" type="Int32"› <value type="Int32"><![CDATA(41]></value> </field> <field name="Index" type="Int32"> <value type="Int32"><![CDATA(01]></value> </field> <field name="EntityTypeName" type="String"> <value type="String"><!(CDATA[Locations])></value> </field> <field name="EntityGuid" type="Guidn> <value type="Guid"><!(CDATA[929d4e49-d33c-4ada-b410-d8822d4105d4])></value> </field> <field name="Description" type="String"> <empty /> </field> <field name="CreationDate" type="TimeStamp"› <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:25.594</value> </field> <field name="LastModifiedDate" type="TimeStamp"› EFTA01621384  <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:27.010</value> </field> <multiField name="Tags" type="String"> <value type="String"><!(CDATA[Responsive)]></value> </multiField> </entityBookmark> <entityBookmark name="" id="f7b6blbf-6c2d-420f-8436-63bbac840496" type="EntityBookmark"> <field name="BookmarkId" type="Int32"› <value type="Int32"><![CDATA(5]]></value> </field> <field name="Index" type="Int32"> <value type="Int32"><![CDATA(01]></value> </field> <field name="EntityTypeName" type="String"> <value type="String"><!(CDATA[User Accounts]]></value> </field> <field name="EntityGuid" type="Guidn> <value type="Guid"><!(CDATA[773fae5f-962d-4858-b272-386e152e64cf)]></value> </field> <field name="Description" type="String"> <empty /> </field> <field name="CreationDate" type="TimeStamp"> <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:34.817</value> </field> <field name="LastModifiedDate" type="TimeStampu> <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:34.817</value> </field> <multiField name="Tags" type="String"› <value type="String"><!(CDATA[Responsivej]></value> </multiField> </entityBookmark> <entityBookmark name="" id="c38f1e50-7711-4d30-bb65-cf519854f250" type="EntityBookmark"› <field name="BookmarkId" type="Int32"› <value type="Int32"><![CDATA(6]]></value> </field> <field name="Index" type="Int32"> <value type="Int32"><![CDATA(01]></value> </field> <field name="EntityTypeName" type="String"> <value type="String"><!(CDATA[User Accounts]]></value> </field> <field name="EntityGuid" type="Guid"› <value type="Guid"><!(CDATA[15c4clal-7417-4f13-a0a4-cbeea918644a)]></value> </field> <field name="Description" type="String"› <empty /> </field> <field name="CreationDate" type="TimeStampw> <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:34.817</value> </field> <field name="LastModifiedDate" type="TimeStamp"› <value type="TimeStamp" format="DateTimeOnly">2020-11-02T18:58:34.817</value> </field> <multiField name="Tags" type="String"› <value type="String"><!(CDATA[Responsivej]></value> </multiField> </entityBookmark> <entityBookmark name="" id="0e864972-ee07-4fcf-8e07-2934bbldfd36" type="EntityBookmark"› <field name="BookmarkId" type="Int32"› <value type="Int32"><![CDATA(7]]></value> </field> <field name="Index" type="Int32"> <value type="Int32"><![CDATA(01]></value> </field> <field name="EntityTypeName" type="String"> <value type="String"><!(CDATA[User Accounts]]></value> </field> <field name="EntityGuid" type="Guidn> <value type="Guid"><!(CDATA[7915d80b-e943-4dab-8d05-60a08a72418c]]></value> </field> <field name="Description" type="String"> <empty /> </field> <field name="C