DFIR Swarm

Forensic report

BELKACTF6

25 findings, 18 at high confidence finished

Findings

18 at high confidence

Indicators

recorded with their source

Dated events

on the timeline

Evidence files

13.5 GB

Elapsed

50 min

10 agents

Spend

$77.32

of $100.00 cap

Examiner: Halil Ozturkci
Run: s821c
Period: 2026-09-20T18:03:46Z → 2026-09-20T18:54:17.540Z
Tool: DFIR Swarm 0.3.0
Generated: 2026-09-20T19:40:34.370Z

1Summary of findingswhat the run concluded, by confidence
2Scope and evidencewhat it was given, and the hash of each file
3Timelineevery dated event, in order
4Indicators and findingsthe exhibits those conclusions rest on
5Methodwho ran it, on what, for how much
6Artifacts producedwhat the run produced, hashed
7Limitationswhat this document does not claim
8Chain of custodythe custody record
9The swarm's own report (report.md)the swarm's own words, verbatim

Section numbers, not page numbers: the pagination belongs to whatever prints this file, and a number this document computed itself would be wrong in every engine but one. swarm.sh report <id> --pdf prints it through a browser, which numbers the pages in the footer and puts this document's title and the print date at the top of each one.

Summary of findings

25 recorded

What the swarm concluded, strongest first. Each card carries the exhibit number its full entry has in §4, and the source it rests on. A claim with no evidence line is a claim this document does not stand behind.

High confidence18

E-55

The BitLocker recovery-key identifier recovered from iPhone Notes (929983CA-5012-49E9-A194-4550C08C6127) matches a protector GUID in vault.vhdx metadata after normal BitLocker little-endian GUID normalization, strongly tying that recovery key to the Vault container.

work/extracted/s821c08/vault.vhdx + iPhone Notes NoteStore.sqlite

E-53

Q11 bill-template designer first name is Drew (@diddyflowers / Dee 🌸), girlfriend of William; last name not in Telegram, Notes, or AddressBook

Telegram chat 36891850763; NoteStore title Gift ideas

E-52

Q17 offshore institution is Crooked River Bank, Panama, SWIFT CRVBPA2P; account Consulting Services Inc 9876543210, 50 Offshore Blvd, Panama City

Telegram Chase secret chat 37123392845 hex decrypted with SecuEncrypt affine cipher (char-sum 1703)

E-50

Q17 SWIFT of the Panama offshore account is CRVBPA2P (Crooked River Bank, account Consulting Services Inc. 9876543210, 50 Offshore Blvd, Panama City). Decoded from Telegram secret chat 37123392845 (Chase) using iPhone Shortcuts SecuDecrypt affine cipher after key rotations +G then +O (key char-sum 1703).

work/s821c02/tg_messages.txt CHAT 37123392845 + Shortcuts SecuEncrypt/SecuDecrypt in Shortcuts.sqlite

E-47

iPhone Shortcuts SecuEncrypt/SecuDecrypt implement a custom affine cipher (a=2*(sum(key)%137)+1, b=sum(key)%89+1) used for Telegram secret-chat messages; the key is prompted at runtime and not stored

private/var/mobile/Library/Shortcuts/Shortcuts.sqlite ZSHORTCUT name SecuEncrypt/SecuDecrypt

E-41

Q3 Telegram shady accounts: @diddyflowers (Drew/Dee designer), @locknload771 (Chase), @Sm00thOperat0r (Max), @JesusStreeton1999 (ATM mule); gang group the.party id 8419629920

iPhone Telegram postbox db_sqlite table t2/t7 work/extracted/s821c05/telegram/.../postbox/db/db_sqlite

E-39

iPhone Notes (iTunes backup NoteStore.sqlite) contain a BitLocker recovery password 590238-514580-359986-088242-029766-319495-410509-636911 for identifier 929983CA-5012-49E9-A194-4550C08C6127

Users/phorger/AppData/Roaming/Apple Computer/MobileSync/Backup/46803e574938af07acaf4ff465b25360e9680067/4f/4f98687d8ab0d6d1a371110e6b7300f6e465bef2 (inode 151744) ZICNOTEDATA Z_PK=4 title BitLocker recovery

E-36

iPhone Notes contain a BitLocker recovery key that should unlock the laptop Vault VHDX (Q8 cluster: Q6/Q15–Q18)

private/var/mobile/Containers/Shared/AppGroup/AF67BA79-B4B6-4F89-AD78-9054620F3322/NoteStore.sqlite

E-35

Q3 Telegram accounts owner discussed shady stuff with: @diddyflowers, @locknload771, @Sm00thOperat0r, @JesusStreeton1999

Telegram iOS postbox t7 messages + t2 peers; work/extracted/s821c05/telegram/.../account-112545592466388074/postbox/db/db_sqlite

E-28

A likely encrypted container is stored as the NTFS alternate data stream Users/phorger/Documents/desktop.ini:vault.vhdx and mounts as volume Y: labeled Vault.

catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt; Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/Vault (Y).lnk; Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/B500 ATM Technical Documentation.pdf.lnk

E-27

The Windows laptop user profile is phorger.

catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt

E-26

Q8 encrypted container is NTFS ADS C:\Users\phorger\Documents\desktop.ini:vault.vhdx (BitLocker VHDX mounted as Y:\ Vault, protector GUID 1C3C8323-FED0-45C9-8A56-BFA3D4871811)

Users/phorger/Documents/desktop.ini:vault.vhdx (inode 102124-128-4); Recent/Vault (Y).lnk inode 35016; BitLocker Recovery Key LNK inode 52650

E-19

Q8 encrypted container is C:\Users\phorger\Documents\desktop.ini:vault.vhdx (BitLocker VHDX ADS, mounted as Y:, GUID 1C3C8323-FED0-45C9-8A56-BFA3D4871811)

istat inode 102124-128-4; LNKs in Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/

E-18

Q1 Apple ID used on the imaged iPhone is billthemegakill@icloud.com

inputs/BelkaCTF_6_CASE240405_D201AP.tar → private/var/mobile/Library/Accounts/Accounts3.sqlite

E-17

Q2 iPhone owner full name is William Phorger

inputs/BelkaCTF_6_CASE240405_D201AP.tar → AddressBook.sqlitedb and Accounts3.sqlite

E-6

Apple ID used on the iPhone is billthemegakill@icloud.com

private/var/mobile/Library/Accounts/Accounts3.sqlite (ZACCOUNT table)

E-5

iPhone owner's full name is William Phorger

private/var/mobile/Library/PersonalizationPortrait/Contacts/me_card.pb

E-3

Q5 laptop username is phorger (profile Users/phorger, NTUSER.DAT inode 101611-128-4)

catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt

Medium confidence6

E-56

The new BitLocker tool parsed vault.vhdx metadata and found the matching protector GUID, but decryption with the recovered password still returned authentication-tag failures, so the remaining blocker appears to be tooling/implementation rather than lack of a candidate key.

work/extracted/s821c08/vault.vhdx

E-54

The BitLocker protector identifier in the iPhone Note (929983CA-5012-49E9-A194-4550C08C6127) matches one protector parsed from vault.vhdx, indicating the note is for the Vault container.

work/extracted/s821c08/vault.vhdx; iPhone NoteStore BitLocker recovery note

E-42

Q4 William lives at Hillslope Drive, Hilltop, East Saint Louis, IL 62203 (38.5924436,-90.057325)

private/var/root/Library/Caches/locationd/consolidated.db GeoFences row for com.apple.reminders

E-32

A VMware shared-folder copy of the BitLocker recovery key existed outside the imaged filesystem, which may be required to unlock the Vault Y: container and reach bank/statement artefacts.

Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/BitLocker Recovery Key 1C3C8323-FED0-45C9-8A56-BFA3D4871811.TXT.lnk; vault.vhdx extract

E-30

Telegram Web cache on the laptop includes contacts/usernames diddyflowers and billthemegakill, consistent with discussions involving @diddyflowers and @billthemegakill.

Users/phorger/AppData/Local/Microsoft/Edge/User Data/Default/IndexedDB/https_web.telegram.org_0.indexeddb.leveldb/000003.log; Edge History; Firefox places.sqlite

E-1

The laptop's primary user appears to be phorger, based on the NTFS user profile directory Users/phorger and presence of NTUSER.DAT under that profile.

catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt

Recorded without a confidence1

E-57

Laptop VHDX vault.vhdx BitLocker FVE metadata confirmed at 0x8400000 with recovery password protector GUID matching iPhone Notes identifier 929983CA-5012-49E9-A194-4550C08C6127; CCM decrypt blocked by tool limitation (InvalidTag on all stretch variants)

work/extracted/s821c04/vault.vhdx FVE metadata at offset 0x8400000

Scope and evidence

8 files · 13.5 GB

Copied from /Users/halilozturkci/DFIR/SwarmInputs/belkactf6 at 2026-09-20T18:01:53Z into inputs/, which no agent may write. The harness refuses write, edit and claim_file on it, restores a shell write from a pristine copy, and where the host allows it runs each pane with inputs/ read-only at the kernel.

Guard requested on, set up as seatbelt; measured per pane: s821c00 kernel s821c01 kernel s821c02 kernel s821c03 kernel s821c04 kernel s821c05 kernel s821c06 kernel s821c07 kernel s821c08 kernel s821c09 kernel.

File	Size	sha256 at kickoff
`inputs/BelkaCTF_6_CASE240405_D201AP.tar`	4.8 GB	4ef69a6292cdffd63fc4d0a5bc47ca98fa47ad59cc7846140e24cf1e30214aff
`inputs/BelkaCTF_6_CASE240405_LAPTOP.E01`	1.5 GB	5528361e35f711f1f3056404dc1649f1c6d6ae099037b47217c73ee18d83e56e
`inputs/BelkaCTF_6_CASE240405_LAPTOP.E02`	1.5 GB	05a9b653f35864c997362afb7f9d8152a57ea0f9ad3c18bed8e315a5d859a405
`inputs/BelkaCTF_6_CASE240405_LAPTOP.E03`	1.5 GB	e6561b9f0e633b744d5454131613a5bf0c69f7d0bb6b61c15845419fc43f2a2f
`inputs/BelkaCTF_6_CASE240405_LAPTOP.E04`	1.5 GB	384de0059098db8312f6f6b52b43f509569eaec99b77cf3b6703021461b08ed2
`inputs/BelkaCTF_6_CASE240405_LAPTOP.E05`	1.5 GB	a7d826d58aa1548c37e7483a19e6b0f404d72564a010160947ecf764b6b5319a
`inputs/BelkaCTF_6_CASE240405_LAPTOP.E06`	1.4 GB	8adb8259c2df9c984741b07ee35b888c3d43193a882039747a08a5e9de2406b6
`inputs/CASE.md`	1.5 KB	e01f34a4d7be3dfe4c16084ed3ea195ee7b4f572c14232a742aa9a1b4d5dcef7

8 files, 13.5 GB in total.

Timeline

21 events

21 dated events, in time order, every timestamp UTC. The exhibit number is the ledger's own sequence, so the console, ledger.jsonl and this rail all name the same row.

2023-11-1200:00:00ZE-38

BitLocker recovery note last opened on iPhone (Core Data ZLASTOPENEDDATE 721371129 ≈ 2023-11-12)

Source
NoteStore.sqlite ZICCLOUDSYNCINGOBJECT Z_PK=11 ZTITLE1=BitLocker recovery
Evidence
ZLASTOPENEDDATE 721371129.066344 (Apple epoch 2001-01-01); ZCREATIONDATE3 721371128.238402
2023-12-1421:47:00ZE-44

routined recorded an overnight visit in Dubai Marina (25.08876,55.14716)

Source
private/var/mobile/Library/Caches/com.apple.routined/Cache.sqlite ZRTVISITMO
Evidence
ZLOCATIONLATITUDE 25.088760966797317 ZLOCATIONLONGITUDE 55.147160562762444 entry 724283220.192099 = 2023-12-14 21:47:00 UTC exit 724303140.232148 = 2023-12-15 03:19:00 UTC
2023-12-2419:30:42ZE-43

iOS locationd created a Reminders geofence at 38.5924436,-90.057325 (Hillslope Drive, East Saint Louis IL)

Source
private/var/root/Library/Caches/locationd/consolidated.db GeoFences
Evidence
Timestamp 725128642 Apple epoch = 2023-12-24 ~19:30 UTC; BundleId RemindersAlerts
2024-01-0301:16:07ZE-20

Element EventStore lock and seshat index files are timestamped in the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/AppData/Roaming/Element/EventStore/seshat-index.key' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
2024-01-1512:44:10ZE-31

A BitLocker recovery key text file for GUID 1C3C8323-FED0-45C9-8A56-BFA3D4871811 was opened from a VMware shared folder.

Source
Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/BitLocker Recovery Key 1C3C8323-FED0-45C9-8A56-BFA3D4871811.TXT.lnk
Evidence
exiftool and UTF-16LE string extraction from work/s821c08/BitLocker_Recovery_Key.lnk show path \\vmware-host\Shared Folders\VMSHARED\New folder\BitLocker Recovery Key 1C3C8323-FED0-45C9-8A56-BFA3D4871811.TXT; timeline entry at 2024-01-15T12:44:10Z for inode 52650-128-4
2024-01-1513:00:59ZE-7

The Windows Recent Items shortcut 776AR-04U.PDF.lnk is timestamped in the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/776AR-04U.PDF.lnk' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
2024-01-1513:01:03ZE-33

The mounted Vault Y: volume was used to open 776AR-04U.PDF from Firefox.

Source
Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/776AR-04U.PDF.lnk; Firefox places.sqlite
Evidence
exiftool work/s821c08/776AR-04U.PDF.lnk shows Local Base Path Y:\776AR-04U.PDF; sqlite query against work/s821c08/firefox_places.sqlite returns file:///Y:/776AR-04U.PDF at 2024-01-15 13:01:03
2024-01-1513:13:26ZE-11

The Windows Recent Items shortcut B500 ATM Technical Documentation.pdf.lnk is timestamped in the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/B500 ATM Technical Documentation.pdf.lnk' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
2024-01-1513:13:26ZE-29

The mounted Vault Y: volume was used to open B500 ATM Technical Documentation.pdf from Firefox.

Source
Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/B500 ATM Technical Documentation.pdf.lnk; Firefox places.sqlite
Evidence
exiftool work/s821c08/B500_ATM_Technical_Documentation.pdf.lnk shows Local Base Path Y:\B500 ATM Technical Documentation.pdf; sqlite query against work/s821c08/firefox_places.sqlite returns file:///Y:/B500%20ATM%20Technical%20Documentation.pdf at 2024-01-15 13:13:26
2024-01-1513:13:42ZE-23

Firefox profile database places.sqlite is timestamped under the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/AppData/Roaming/Mozilla/Firefox/Profiles/12vcznj3.default-release/places.sqlite' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
2024-02-0222:26:49ZE-10

The Windows Recent Items shortcut powder.zip.lnk is timestamped in the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/powder.zip.lnk' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
2024-02-0222:26:53ZE-8

The Desktop file Powder.exe is timestamped in the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/Desktop/Powder.exe' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
2024-03-0200:00:00ZE-48

iPhone screenshot of Google Authenticator for Crooked River Bank (crbk.org)

Source
private/var/mobile/Media/DCIM/100APPLE/IMG_0032.PNG
Evidence
Photos.sqlite ZASSET ZFILENAME IMG_0032.PNG ZDATECREATED 731021657 Apple epoch = 2024-03-02
2024-03-1818:53:20ZE-12

The iTunes device file iPodDevices.xml is timestamped under the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/AppData/Local/Apple Computer/iTunes/iPodDevices.xml' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
2024-03-2010:31:10ZE-46

iPhone Safari visited Crooked River Bank (crbk.org) including forgot-password

Source
private/var/mobile/Library/Safari/History.db
Evidence
history_visits datetime(visit_time+978307200) = 2024-03-20 10:31:10 UTC
2024-03-2600:00:00ZE-25

Bank UI screenshot Capture2.png shows PAB debit AIRBNB 14158B00005959 -47.3 PAB

Source
Users/phorger/Pictures/Capture2.png inode 113422-128-3
Evidence
icat -o 673792 … 113422; visual AIRBNB 14158B00005959 Mar 26 2024 -47.3 PAB
2024-03-2700:00:00ZE-24

Bank UI screenshot Capture2.png shows PAB debit LAARI ADA St. Louis -33.25 PAB

Source
Users/phorger/Pictures/Capture2.png inode 113422-128-3
Evidence
icat -o 673792 inputs/BelkaCTF_6_CASE240405_LAPTOP.E01 113422; PNG 967x196; OCR/visual: LAARI ADA St. Louis Mar 27 2024 -33.25 PAB
2024-04-0100:00:00ZE-40

Gang reports ATM rejecting cash; stubborn machine linked at https://bit.ly/3VKt3er

Source
Telegram the.party chat t7
Evidence
work/s821c02/tg_messages.txt chat 8419629920 message containing bit.ly/3VKt3er
2024-04-0109:59:49ZE-9

Firefox web.telegram.org cache files are timestamped under the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/AppData/Roaming/Mozilla/Firefox/Profiles/12vcznj3.default-release/storage/default/https+++web.telegram.org/cache/caches.sqlite' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
2024-04-0500:29:01ZE-21

ConnectedDevicesPlatform ActivitiesCache.db is timestamped under the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/AppData/Local/ConnectedDevicesPlatform/L.phorger/ActivitiesCache.db' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
2024-04-0500:29:02ZE-22

Comms UnistoreDB store.vol is timestamped under the phorger profile.

Source
catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt
Evidence
grep -F 'Users/phorger/AppData/Local/Comms/UnistoreDB/store.vol' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/bodyfile.txt

Indicators and findings

11 indicators · 25 findings

Indicators (11)

E-2ioc high

Windows account/profile name: phorger

Source: catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt
Evidence: grep -F 'Users/phorger' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt | head
Recorded by: s821c07

E-4ioc high

Encrypted container candidate ADS C:\Users\phorger\Documents\desktop.ini:vault.vhdx (inode 102124-128-4); also Recent Vault (Y).lnk suggesting mounted as Y:

Source: catalog filelist + Users/phorger/Documents/desktop.ini:vault.vhdx
Evidence: filelist line r/r 102124-128-4 Users/phorger/Documents/desktop.ini:vault.vhdx; Recent inode 35016-128-1 Vault (Y).lnk
Recorded by: s821c02

E-13ioc high

Encrypted container candidate: NTFS ADS Users/phorger/Documents/desktop.ini:vault.vhdx (inode 102124-128-4) plus Recent shortcut Vault (Y).lnk

Source: catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt
Evidence: fls path Users/phorger/Documents/desktop.ini:vault.vhdx inode 102124; Vault (Y).lnk inode 35016
Recorded by: s821c01

E-14ioc high

Laptop Windows profile username is phorger (Users/phorger, SID suffix 1000 in AppRepository pckgdep)

Source: catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt
Evidence: grep Users/phorger catalog/.../filelist.txt; dir inode 101610-144-5; NTUSER.DAT inode 101611-128-4
Recorded by: s821c01

E-15ioc high

Apple ID / iCloud account billthemegakill@icloud.com on the imaged iPhone

Source: private/var/mobile/Library/Accounts/Accounts3.sqlite (ZACCOUNT.ZUSERNAME; ZACCOUNTPROPERTY appleId/primaryEmail)
Evidence: sqlite3 Accounts3.sqlite "SELECT ZUSERNAME FROM ZACCOUNT WHERE ZUSERNAME LIKE '%icloud%';" — rows 4,5,7,8,9,10,14,15,16,18; sha256 Accounts3.sqlite 2d684e7cda89e7e20687ba2c39c995cb0a227d48ce1e4b26c4f2d7ea50ce416f
Recorded by: s821c00

E-16ioc high

iPhone owner identity William Phorger

Source: private/var/mobile/Library/AddressBook/AddressBook.sqlitedb ABPerson ROWID=1 (MeIdentifier); Accounts3.sqlite ZACCOUNTPROPERTY firstName/lastName/FullUserName
Evidence: SELECT First,Last FROM ABPerson WHERE ROWID=1 → William Phorger; ABStore.MeIdentifier=1; NSKeyedArchiver firstName=William lastName=Phorger FullUserName=William Phorger. sha256 AddressBook.sqlitedb 18d9f22371f4cddfdd7babfa4ed18a75fd834bec1fbf1aa3daa4072a686454dc
Recorded by: s821c00

E-34ioc high

Telegram usernames of gang contacts: @diddyflowers (Drew), @locknload771 (Chase), @Sm00thOperat0r (Max/the.boss), @JesusStreeton1999 (Streeton mule), @megakilley/@billthemegakill (owner), bot @prochefbakerbot

Source: Telegram postbox t2 peers in account-112545592466388074/postbox/db/db_sqlite
Evidence: Peer IDs: 36891850763 diddyflowers; 37123392845 locknload771; 37173443476 Sm00thOperat0r/the.boss; 36442128904 JesusStreeton1999; 37203642159 billy/megakilley/billthemegakill; 36971568826 prochefbakerbot; group 8419629920 the.party
Recorded by: s821c00

E-37ioc high

BitLocker recovery key 590238-514580-359986-088242-029766-319495-410509-636911 for identifier 929983CA-5012-49E9-A194-4550C08C6127

Source: iPhone Notes NoteStore.sqlite ZICCLOUDSYNCINGOBJECT title 'BitLocker recovery' (Z_PK 11) / ZICNOTEDATA Z_PK 4
Evidence: work/extracted/s821c00/.../NoteStore.sqlite note identifier B6A50DAF-59B4-4F2D-8D80-97873DB38F1F; gzip ZDATA contains Identifier 929983CA-5012-49E9-A194-4550C08C6127 and Recovery key 590238-514580-359986-088242-029766-319495-410509-636911
Recorded by: s821c00

E-45ioc high

Offshore bank website crbk.org titled Crooked River Bank visited in iPhone Safari

Source: private/var/mobile/Library/Safari/History.db history_items id 80
Evidence: url https://crbk.org/ title Crooked River Bank visit 2024-03-20 10:31:10 UTC; also /forgot-password
Recorded by: s821c00

E-49ioc high

Crooked River Bank 2FA issuer www.crbk.org: crbk.org in Google Authenticator screenshot IMG_0032.PNG

Source: private/var/mobile/Media/DCIM/100APPLE/IMG_0032.PNG
Evidence: Screenshot of Google Authenticator showing www.crbk.org: crbk.org TOTP code 917 049; file date 2024-03-02
Recorded by: s821c00

E-51ioc high

Crooked River Bank SWIFT CRVBPA2P; account Consulting Services Inc. 9876543210; address 50 Offshore Blvd, Panama City, Panama

Source: Telegram secret chat with Chase (decoded)
Evidence: SecuDecrypt sum=1703 on hex blob starting 1965dc82eda62f00... yields bank details sentence.
Recorded by: s821c01

Findings (25)

E-1finding medium

The laptop's primary user appears to be phorger, based on the NTFS user profile directory Users/phorger and presence of NTUSER.DAT under that profile.

Source: catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt
Evidence: grep -E 'Users/phorger($|/)|Users/phorger/NTUSER\.DAT' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt | head -n 20
Recorded by: s821c07

E-3finding high

Q5 laptop username is phorger (profile Users/phorger, NTUSER.DAT inode 101611-128-4)

Source: catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt
Evidence: grep Users/phorger NTUSER.DAT; inode 101611-128-4 Users/phorger/NTUSER.DAT
Recorded by: s821c02

E-5finding high

iPhone owner's full name is William Phorger

Source: private/var/mobile/Library/PersonalizationPortrait/Contacts/me_card.pb
Evidence: strings on me_card.pb: "William", "Phorger", "billthemegakill@icloud.com"
Recorded by: s821c03

E-6finding high

Apple ID used on the iPhone is billthemegakill@icloud.com

Source: private/var/mobile/Library/Accounts/Accounts3.sqlite (ZACCOUNT table)
Evidence: sqlite3 query: SELECT ZUSERNAME FROM ZACCOUNT WHERE ZUSERNAME LIKE '%icloud%'
Recorded by: s821c03

E-17finding high

Q2 iPhone owner full name is William Phorger

Source: inputs/BelkaCTF_6_CASE240405_D201AP.tar → AddressBook.sqlitedb and Accounts3.sqlite
Evidence: ABPerson ROWID 1 First=William Last=Phorger; Me card (ABStore.MeIdentifier=1); iCloud account properties firstName=William lastName=Phorger FullUserName=William Phorger (ZOWNER 4,8,10,16)
Recorded by: s821c00

E-18finding high

Q1 Apple ID used on the imaged iPhone is billthemegakill@icloud.com

Source: inputs/BelkaCTF_6_CASE240405_D201AP.tar → private/var/mobile/Library/Accounts/Accounts3.sqlite
Evidence: ZACCOUNT Z_PK=8 type com.apple.account.AppleAccount (iCloud) ZUSERNAME=billthemegakill@icloud.com; also AuthKit/IDMS Z_PK=4/5; extract work/extracted/s821c00/
Recorded by: s821c00

E-19finding high

Q8 encrypted container is C:\Users\phorger\Documents\desktop.ini:vault.vhdx (BitLocker VHDX ADS, mounted as Y:, GUID 1C3C8323-FED0-45C9-8A56-BFA3D4871811)

Source: istat inode 102124-128-4; LNKs in Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/
Evidence: icat -o 673792 ... 102124-128-4; LNK 127776 Y:\B500 ATM Technical Documentation.pdf; LNK 34802 Y:\Spending.xlsx; LNK 127739 Y:\776AR-04U.PDF
Recorded by: s821c02

E-26finding high

Q8 encrypted container is NTFS ADS C:\Users\phorger\Documents\desktop.ini:vault.vhdx (BitLocker VHDX mounted as Y:\ Vault, protector GUID 1C3C8323-FED0-45C9-8A56-BFA3D4871811)

Source: Users/phorger/Documents/desktop.ini:vault.vhdx (inode 102124-128-4); Recent/Vault (Y).lnk inode 35016; BitLocker Recovery Key LNK inode 52650
Evidence: istat -o 673792 … 102124 shows $DATA Name: vault.vhdx Non-Resident Sparse size 608174080; LNK strings Y:\\ and Vault
Recorded by: s821c01

E-27finding high

The Windows laptop user profile is phorger.

Source: catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt
Evidence: grep -E '^[drv]/[drv] .*Users/[^/]+$' catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt -> Users/phorger (inode 101610-144-5)
Recorded by: s821c08

E-28finding high

A likely encrypted container is stored as the NTFS alternate data stream Users/phorger/Documents/desktop.ini:vault.vhdx and mounts as volume Y: labeled Vault.

Source: catalog/BelkaCTF_6_CASE240405_LAPTOP.E01/p673792/filelist.txt; Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/Vault (Y).lnk; Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/B500 ATM Technical Documentation.pdf.lnk
Evidence: icat -o 673792 inputs/BelkaCTF_6_CASE240405_LAPTOP.E01 102124-128-4 > work/extracted/s821c08/vault.vhdx && file work/extracted/s821c08/vault.vhdx (VHDX with -FVE-FS- BitLocker signature); exiftool work/s821c08/VaultY.lnk work/s821c08/B500_ATM_Technical_Documentation.pdf.lnk shows Local Base Path Y:\ and Volume Label Vault
Recorded by: s821c08

E-30finding medium

Telegram Web cache on the laptop includes contacts/usernames diddyflowers and billthemegakill, consistent with discussions involving @diddyflowers and @billthemegakill.

Source: Users/phorger/AppData/Local/Microsoft/Edge/User Data/Default/IndexedDB/https_web.telegram.org_0.indexeddb.leveldb/000003.log; Edge History; Firefox places.sqlite
Evidence: strings/regex over icat extracts in work/s821c08/tg/000003.log shows first_name Dee -> username diddyflowers and first_name billy last_name megakilley -> username billthemegakill; Edge History URLs include https://web.telegram.org/k/#@diddyflowers and Firefox places include https://web.telegram.org/a/#6827079691
Recorded by: s821c08

E-32finding medium

A VMware shared-folder copy of the BitLocker recovery key existed outside the imaged filesystem, which may be required to unlock the Vault Y: container and reach bank/statement artefacts.

Source: Users/phorger/AppData/Roaming/Microsoft/Windows/Recent/BitLocker Recovery Key 1C3C8323-FED0-45C9-8A56-BFA3D4871811.TXT.lnk; vault.vhdx extract
Evidence: LNK target path \\vmware-host\Shared Folders\VMSHARED\New folder\BitLocker Recovery Key 1C3C8323-FED0-45C9-8A56-BFA3D4871811.TXT plus BitLocker signature in work/extracted/s821c08/vault.vhdx
Recorded by: s821c08

E-35finding high

Q3 Telegram accounts owner discussed shady stuff with: @diddyflowers, @locknload771, @Sm00thOperat0r, @JesusStreeton1999

Source: Telegram iOS postbox t7 messages + t2 peers; work/extracted/s821c05/telegram/.../account-112545592466388074/postbox/db/db_sqlite
Evidence: t7 chat 0x896ecf80b (Drew/@diddyflowers) bill design; 0x8a7b5bb94 (Max/@Sm00thOperat0r) print lab; 0x8a4ba054d (Chase/@locknload771) secret channel; group 0x1f5d95b60 the.party with Streeton/@JesusStreeton1999 as ATM mule. Owner self @megakilley/@billthemegakill excluded.
Recorded by: s821c00

E-36finding high

iPhone Notes contain a BitLocker recovery key that should unlock the laptop Vault VHDX (Q8 cluster: Q6/Q15–Q18)

Source: private/var/mobile/Containers/Shared/AppGroup/AF67BA79-B4B6-4F89-AD78-9054620F3322/NoteStore.sqlite
Evidence: Note title BitLocker recovery; identifier 929983CA-5012-49E9-A194-4550C08C6127 (differs from LNK GUID 1C3C8323-FED0-45C9-8A56-BFA3D4871811 — try this key anyway)
Recorded by: s821c00

E-39finding high

iPhone Notes (iTunes backup NoteStore.sqlite) contain a BitLocker recovery password 590238-514580-359986-088242-029766-319495-410509-636911 for identifier 929983CA-5012-49E9-A194-4550C08C6127

Source: Users/phorger/AppData/Roaming/Apple Computer/MobileSync/Backup/46803e574938af07acaf4ff465b25360e9680067/4f/4f98687d8ab0d6d1a371110e6b7300f6e465bef2 (inode 151744) ZICNOTEDATA Z_PK=4 title BitLocker recovery
Evidence: icat -o 673792 … 151744; gzip-decompress ZDATA; plaintext Identifier 929983CA-5012-49E9-A194-4550C08C6127 Recovery key 590238-514580-359986-088242-029766-319495-410509-636911
Recorded by: s821c01

E-41finding high

Q3 Telegram shady accounts: @diddyflowers (Drew/Dee designer), @locknload771 (Chase), @Sm00thOperat0r (Max), @JesusStreeton1999 (ATM mule); gang group the.party id 8419629920

Source: iPhone Telegram postbox db_sqlite table t2/t7 work/extracted/s821c05/telegram/.../postbox/db/db_sqlite
Evidence: t2 keys 36891850763 diddyflowers, 37123392845 locknload771, 37173443476 Sm00thOperat0r, 36442128904 JesusStreeton1999; dump work/s821c02/tg_messages.txt
Recorded by: s821c02

E-42finding medium

Q4 William lives at Hillslope Drive, Hilltop, East Saint Louis, IL 62203 (38.5924436,-90.057325)

Source: private/var/root/Library/Caches/locationd/consolidated.db GeoFences row for com.apple.reminders
Evidence: GeoFences Latitude=38.5924436 Longitude=-90.057325 Distance=114 Name=CEE407BF-.../F6DD05FD-... Timestamp=725128642 (~2023-12-24). Nominatim reverse: Hillslope Drive, Hilltop, East Saint Louis, Saint Clair County, Illinois, 62203. Home Wi-Fi SSID TWR9 (known-networks.plist).
Recorded by: s821c00

E-47finding high

iPhone Shortcuts SecuEncrypt/SecuDecrypt implement a custom affine cipher (a=2*(sum(key)%137)+1, b=sum(key)%89+1) used for Telegram secret-chat messages; the key is prompted at runtime and not stored

Source: private/var/mobile/Library/Shortcuts/Shortcuts.sqlite ZSHORTCUT name SecuEncrypt/SecuDecrypt
Evidence: ZSHORTCUTACTIONS ZDATA UTF-16 JS: var key; sum+=key.charCodeAt; a=sum%137; a=2a+1; b=sum%89+1; charCode=(inputa+b)%256 then hex. Ask prompt is 'key'.
Recorded by: s821c00

E-50finding high

Source: work/s821c02/tg_messages.txt CHAT 37123392845 + Shortcuts SecuEncrypt/SecuDecrypt in Shortcuts.sqlite
Evidence: Affine decrypt: a=2*(sum%137)+1, b=sum%89+1, ciphertext hex from postbox; plaintext includes 'SWIFT Code: CRVBPA2P'.
Recorded by: s821c01

E-52finding high

Q17 offshore institution is Crooked River Bank, Panama, SWIFT CRVBPA2P; account Consulting Services Inc 9876543210, 50 Offshore Blvd, Panama City

Source: Telegram Chase secret chat 37123392845 hex decrypted with SecuEncrypt affine cipher (char-sum 1703)
Evidence: work/s821c02/tg_messages.txt first hex blob 406 chars decrypts to SWIFT CRVBPA2P; IMG_0032.PNG Authenticator issuer crbk.org; Safari History.db https://crbk.org/
Recorded by: s821c00

E-53finding high

Q11 bill-template designer first name is Drew (@diddyflowers / Dee 🌸), girlfriend of William; last name not in Telegram, Notes, or AddressBook

Source: Telegram chat 36891850763; NoteStore title Gift ideas
Evidence: tg_messages.txt Drew design/magnetic layer; gzip_note Gift ideas: Drew: wine tasting experience
Recorded by: s821c01

E-54finding medium

The BitLocker protector identifier in the iPhone Note (929983CA-5012-49E9-A194-4550C08C6127) matches one protector parsed from vault.vhdx, indicating the note is for the Vault container.

Source: work/extracted/s821c08/vault.vhdx; iPhone NoteStore BitLocker recovery note
Evidence: bde_unlock on work/extracted/s821c08/vault.vhdx with recovery 590238-514580-359986-088242-029766-319495-410509-636911 returned protector guid ca8399921250e949a1944550c08c6127 (little-endian form of 929983CA-5012-49E9-A194-4550C08C6127) plus a second non-matching protector; decryption did not yet succeed in this pane
Recorded by: s821c08

E-55finding high

Source: work/extracted/s821c08/vault.vhdx + iPhone Notes NoteStore.sqlite
Evidence: bde_unlock path=work/extracted/s821c08/vault.vhdx recovery=590238-514580-359986-088242-029766-319495-410509-636911 returned protector guid ca8399921250e949a1944550c08c6127; NoteStore key identifier is 929983CA-5012-49E9-A194-4550C08C6127
Recorded by: s821c07

E-56finding medium

Source: work/extracted/s821c08/vault.vhdx
Evidence: bde_unlock path=work/extracted/s821c08/vault.vhdx recovery=590238-514580-359986-088242-029766-319495-410509-636911 -> protector guid ca8399921250e949a1944550c08c6127 with errors pad32/0:InvalidTag, sha256/0:InvalidTag, dsha256/0:InvalidTag
Recorded by: s821c07

E-57finding

Source: work/extracted/s821c04/vault.vhdx FVE metadata at offset 0x8400000
Evidence: bde_unlock/bde_unlock2 tools confirm GUID match; all pad32/sha256/dsha256 stretch methods return InvalidTag
Recorded by: s821c04

Method

10 peer agents shared one sandbox and coordinated through an append-only file board. Nobody planned, nobody was assigned a seat, and no agent could direct another. The "Calls itself" column is what each one decided to be, in its own words, after reading the goal.

Agent	Calls itself	Model	Spent	Calls	Tokens
s821c00	iPhone identity — Q1/Q2 done; parsing peer Telegram extracts for Q3 usernames and extracting iPhone location artefacts for Q4/Q7	azure-foundry/grok-4.6	$12.35	128	10,768,890
s821c01	Docs and money — Hunt Q6 first take, Q9 luxury item, Q10 concert, Q11 template designer, Q16 leak source from catalogs and targeted extracts; seed work/flags.md as answers land.	azure-foundry/grok-4.6	$10.81	105	9,320,579
s821c02	Vault unlock — Unlock BitLocker vault.vhdx with the iPhone Notes recovery key, then extract Y: files (Spending.xlsx, 776AR-04U.PDF, B500 ATM PDF, baker) for Q6/Q9/Q15–Q18.	azure-foundry/grok-4.6	$9.44	69	7,609,009
s821c03	Location & Venue Hunter — Q4 William's location, Q7 March celebration venue, Q10 concert from iPhone location data, Wi-Fi networks, photos EXIF, and Telegram chat context	azure-foundry/DeepSeek-V4-Pro	$14.33	237	15,333,582
s821c04	Laptop Deep Dive — Laptop evidence analysis: chasing Drew's full name, Q7 bar venue, Q10 concert details, Q14 printer model — plus trying BitLocker key variations on VHDX	azure-foundry/DeepSeek-V4-Pro	$13.40	217	16,109,140
s821c05	iPhone Identity & Telegram — Answer Q1 (Apple ID), Q2 (owner full name), Q3 (Telegram accounts) from the iPhone image, and chase William/home leads for Q4.	deepseek/deepseek-v4-pro	$0.11	28	646,369
s821c06	laptop-analyst — Analysing the Windows laptop image (EWF) for the laptop-side answers: username, encrypted container, printer, lab, ATM, bank/SWIFT, bank statement, concert, luxury item, template designer, timestamps.	deepseek/deepseek-v4-pro	$0.12	24	558,007
s821c07	Dependency & Timeline — Owning cross-question dependency mapping and merged timeline assembly from the ledger, plus citation verification for findings peers post; will avoid primary laptop-recon overlap unless a gap appears	openai/gpt-5.4	$11.17	272	34,460,865
s821c08	Laptop Recon — Taking initial laptop-side triage: identify Windows user, look for encrypted container, printer, ATM/banking and timeline artifacts, then feed dependencies/flags with evidence-backed findings.	openai/gpt-5.4	$5.60	107	16,360,236
s821c09	—	lmstudio/qwen3.8-27b-uncensored	$0.00	9	134,449

$77.32 of a $100.00 cap, 111,301,126 tokens, 2,287 tool calls in 50 min. Wall-clock cap 60 min. Per-agent cap $15.00.

Toolbox dfir: 12 tools present, 1 missing (esedbexport).

Artifacts produced

323 files

Path	Size	sha256	Where
`work/dependencies.md`	6.6 KB	08d9785a58a19149af3d5cd99726cf81f81e4439720b91ee3cb25870b36b7a15	packaged
`work/extracted/s821c00/private/var/containers/Data/System/23801560-4E89-4EBB-B41C-A73FF3AF4FE8/Library/activation_records/activation_record.plist`	7.7 KB	f6ea9ea48b8fe4c7b57b58c45c68d95697da46f77b1df079281d17409d4e76af	in the sandbox
`work/extracted/s821c00/private/var/containers/Data/System/23801560-4E89-4EBB-B41C-A73FF3AF4FE8/Library/internal/data_ark.plist`	8.1 KB	34fc21b352e8f849087dc5f638cba203da4435cadf4961fc129c884c7950a736	in the sandbox
`work/extracted/s821c00/private/var/mobile/Containers/Shared/AppGroup/AF67BA79-B4B6-4F89-AD78-9054620F3322/NoteStore.sqlite`	292.0 KB	1d9d7ae5f11d86bf253b011d4dd894dc06b7f31614dae4d546de8eac43540f8c	in the sandbox
`work/extracted/s821c00/private/var/mobile/Containers/Shared/AppGroup/AF67BA79-B4B6-4F89-AD78-9054620F3322/NoteStore.sqlite-shm`	32.0 KB	80b8fdb856cf75bf1a99fec5fec2d2080438d9a2c8da5db184ea50a8f1f4013b	in the sandbox
`work/extracted/s821c00/private/var/mobile/Containers/Shared/AppGroup/AF67BA79-B4B6-4F89-AD78-9054620F3322/NoteStore.sqlite-wal`	325.9 KB	09df7af2ea9a05a13817181e53bc6d27d6b0c071a4081f7b31b4098b5760a066	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Accounts/Accounts3.sqlite`	220.0 KB	2d684e7cda89e7e20687ba2c39c995cb0a227d48ce1e4b26c4f2d7ea50ce416f	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Accounts/Accounts3.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Accounts/Accounts3.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Accounts/persona.cache`	413 B	b2e5f4dc34b66ba0995b01bd46db81947e7a525973b51e86a1dd564e47affa6f	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb`	300.0 KB	18d9f22371f4cddfdd7babfa4ed18a75fd834bec1fbf1aa3daa4072a686454dc	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Caches/com.apple.routined/Cache.sqlite`	4.0 KB	b3f176fd152631e986aff7544248fc5be8e9d9ff55b80c11cfe240b09c2bd379	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Caches/com.apple.routined/Cache.sqlite-shm`	32.0 KB	70b4d7d31aea6b52fc8ae6bc6f85342eb957ae0a2d66c26ab33551662fab8e8b	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Caches/com.apple.routined/Cache.sqlite-wal`	877.1 KB	ec8a96f82fbc49c90e40753a9d37768825128b7e26790764cd1d519dbf902a46	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Caches/com.apple.routined/Cloud-V2.sqlite`	4.0 KB	b3f176fd152631e986aff7544248fc5be8e9d9ff55b80c11cfe240b09c2bd379	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Caches/com.apple.routined/Cloud-V2.sqlite-shm`	32.0 KB	ec62423c4e5f3fcdf4e3dcf4ec5d4408bb3cc7cabaa7f191dbf733ab1a07bb8f	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Caches/com.apple.routined/Cloud-V2.sqlite-wal`	591.5 KB	2006216f4ff9ff261f6e149229017ecd9f520a94fe9ceab7efd8da550d827d3b	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Caches/com.apple.routined/Local.sqlite`	4.0 KB	b3f176fd152631e986aff7544248fc5be8e9d9ff55b80c11cfe240b09c2bd379	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Caches/com.apple.routined/Local.sqlite-shm`	32.0 KB	698f617a09347bb9b03837bfc33cfbec4cc033667399c7038ddc6f1d9363dd63	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Caches/com.apple.routined/Local.sqlite-wal`	474.8 KB	82f89b13e729237ac3f75142752c69c312536304e43c78167416e32c825ea335	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Calendar/Calendar.sqlitedb`	944.0 KB	bc81cf8f143af310fd3e3cd126f68df11101eaa80273b70c0c8663e5e2317257	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Calendar/Calendar.sqlitedb-shm`	32.0 KB	c0fae851f86c7f081d4b1519fa965259cb3a68747005fa4313be249b3e20bca3	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Calendar/Calendar.sqlitedb-wal`	16.1 KB	4c0ede7d71fa6c382741529f054694a75b13120c6b898a6b783e32364ca2d6f2	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Maps/navd.cache`	4.0 KB	3d1e98365599c0aadf69ebddee20431cd8525432f9306c8b0e82a09f9ef2b76d	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Maps/navd.cache-wal`	76.5 KB	26e9fe1f42aba789d0af4f0595547eaa640824a2735e2f3cf30de3087c18e5ac	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Notes/notes.sqlite`	140.0 KB	29dfe2b4bfb8d1753c3f04e52a1e61459d265ac45031c2b4c6ffe88c19a96e76	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Notes/notes.sqlite-wal`	128.8 KB	859632f4b3ba0847c81511002a17c6385ed99fd4e5a7df2d2946743e63a42654	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Reminders/Container_v1/Stores/Data-local.sqlite`	580.0 KB	bc4fab078e5b443efcd8df03f5760a85fb3bea38d28616c819735fd1104e68c8	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Reminders/Container_v1/Stores/Data-local.sqlite-shm`	32.0 KB	704be124a05031fedb32e3fe15b983102c7776807eaf2844ff51543685cae1ce	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Reminders/Container_v1/Stores/Data-local.sqlite-wal`	12.1 KB	0d6c70551e22eb0c4022e6f3284609092a5d6bd8e0410aa65ded0d479b89d22d	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Safari/Bookmarks.db`	4.0 KB	3d1e98365599c0aadf69ebddee20431cd8525432f9306c8b0e82a09f9ef2b76d	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Safari/Bookmarks.db-shm`	32.0 KB	416954cdeb6ab9c50418195f76ee4e351a717d7ec4cf9761f7c22bcc074d136f	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Safari/Bookmarks.db-wal`	1.8 MB	2431d273e0479a182f0653f95bc63ba7bf5f239515a9c31ea8b910428d8ac516	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Safari/BrowserState.db`	1.7 MB	a150be61f01879db94c907ec343c49ee8f9907602eb0abde41608edbc2d94e8d	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Safari/BrowserState.db-wal`	2.7 MB	ea1fd544732f100e8676bc0387f6a7cebbb686d71f3ecb742d78815382dd2db4	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Safari/History.db`	136.0 KB	f2f561e23cdd537ae2c3479286d5e368428ea117033bc4b23d0997df0bf4a1e8	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Safari/History.db-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Safari/History.db-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/Shortcuts/Shortcuts.sqlite`	328.0 KB	b0701ed59bd3c26bf7980b0c95ba1fc7efa385fef411f89fd743ce2479ec959d	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/SMS/sms.db`	288.0 KB	93099ce2ad3eb5fdbf41ad41c43e6828c191c119362e8278d8656ed12fb95788	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/SMS/sms.db-shm`	32.0 KB	46af2ea017e322730310f0f9052c1be2fa9b2c053649da171fde1a94084d8647	in the sandbox
`work/extracted/s821c00/private/var/mobile/Library/SMS/sms.db-wal`	587.5 KB	bd852d9189f60a941b2c70580f9f760df44c86b2df32cc081cdd770ad0c6461a	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0002.PNG`	548.9 KB	4c334a4ec37c067df411c7efe5c7c1ceb6cb55960ac9ac1b5c01190c92706ca6	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0008.PNG`	1.0 MB	0521a07dfe9e85b3afb3506550b84bc1f79678e7d91229d094ce384155f8fc44	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0009.JPG`	35.7 KB	59a88579efaecf29dc2451e07bc22e3543faca3f492530d473ddd9aadd88c820	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0010.JPG`	34.1 KB	f27f3c0d3ce343a1e9bf6fe8e982a97a38a84fff31ba8138028dfb41ea7d7f99	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0011.PNG`	1.9 MB	cb2f54b58e68808d40841ffa657fc7c3557a34fef057684a33d6979a7abfc5e1	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0027.JPG`	28.8 KB	281c8f1da11f2fe4ce61143ddf0849ce4b15886a65b538260528a07835198b10	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0028.JPG`	24.0 KB	36b6842bd40fd1f19db90b64fc271e99e67054b84d94a0ae0616bc314cf09989	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0029.WEBP`	71.4 KB	89ecbc006da076a961ad25afcf3f28a5ea7315ea5efe081d0eeb817d804cc84e	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0030.WEBP`	71.4 KB	89ecbc006da076a961ad25afcf3f28a5ea7315ea5efe081d0eeb817d804cc84e	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/DCIM/100APPLE/IMG_0032.PNG`	85.5 KB	2d52b1ffbbfdddb856db9bd8e288f77dda382ecc1c2667e7f754eed365d66906	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/PhotoData/Photos.sqlite`	2.2 MB	f12447874e81e402a46b09d896fc2e22713fa4f1554e1fd05452acf4cee2350b	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/PhotoData/Photos.sqlite-shm`	32.0 KB	62500681fa35c18a84e889f04341db55d01e0c93cfc5891c6d7aac42440ef61f	in the sandbox
`work/extracted/s821c00/private/var/mobile/Media/PhotoData/Photos.sqlite-wal`	3.4 MB	33efa55a155317909a0d3cc4be2a80d061d31e366eb798bcbae718763420e727	in the sandbox
`work/extracted/s821c00/private/var/preferences/com.apple.wifi.known-networks.plist`	1.3 KB	cd0e19bb93e2787f00ac9112ac66361f3e1318a58621ba27c9091c5f7a6347ca	in the sandbox
`work/extracted/s821c00/private/var/preferences/SystemConfiguration/com.apple.wifi-networks.plist`	42 B	9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1	in the sandbox
`work/extracted/s821c00/private/var/root/Library/Caches/locationd/consolidated.db`	64.0 KB	8d8fc41be8f965c13e2b5d544a5c823f19d76f3821b564ee47b1a0e05d4d3acb	in the sandbox
`work/extracted/s821c00/private/var/root/Library/Caches/locationd/consolidated.db-shm`	32.0 KB	f6a09483b9352c21289c3213082ce3625fe2948e6ebecafeff89881b3acccb36	in the sandbox
`work/extracted/s821c00/private/var/root/Library/Caches/locationd/consolidated.db-wal`	32.2 KB	0ba30a3501f65747f9d3f6fa2ba97730cd6ff61b4f3df00e52485213fd2cd323	in the sandbox
`work/extracted/s821c00/private/var/root/Library/Preferences/com.apple.wifi.manager.plist`	2.9 KB	e82ac829fce2107733783242fcf112b1b3ac875d1fcf8a9ba5aef5f7689b5147	in the sandbox
`work/extracted/s821c00/sms/private/var/mobile/Containers/Data/Application/C77DAB23-6182-42FB-A253-9F4CC57338EF/Library/Preferences/com.spotify.client.plist`	117 B	8b0b4c9273b8fd1f381caac6252fb17cc5155bf67c8f75c718e1d2e66cc1f2d5	in the sandbox
`work/extracted/s821c00/sms/private/var/mobile/Library/SMS/sms.db`	288.0 KB	93099ce2ad3eb5fdbf41ad41c43e6828c191c119362e8278d8656ed12fb95788	in the sandbox
`work/extracted/s821c00/sms/private/var/mobile/Library/SMS/sms.db-shm`	32.0 KB	46af2ea017e322730310f0f9052c1be2fa9b2c053649da171fde1a94084d8647	in the sandbox
`work/extracted/s821c00/sms/private/var/mobile/Library/SMS/sms.db-wal`	587.5 KB	bd852d9189f60a941b2c70580f9f760df44c86b2df32cc081cdd770ad0c6461a	in the sandbox
`work/extracted/s821c01/776AR-04U.PDF.lnk`	474 B	4c5b7ff1666e9a38f9429d6e16ed191624514880577d22f7adc6b7613809fb69	in the sandbox
`work/extracted/s821c01/B500_ATM.PDF.lnk`	567 B	c27dd34f5845c1433c057dbea5ccd567e6bca5949c0020a6c7765822de1a530c	in the sandbox
`work/extracted/s821c01/BitLockerRecovery.lnk`	2.1 KB	8564021f6f898a485fa5badfdb2aa0420d5f12034ca817b1039756de557c95b7	in the sandbox
`work/extracted/s821c01/browser/edge_History`	256.0 KB	8fc410100297f3c83d7ed466e2fe21794c8f68c210c253da48194e59cc8013ac	in the sandbox
`work/extracted/s821c01/browser/places.sqlite`	5.0 MB	913c25074e7e9a34f5fd0fb7f64a763f177148b20f07638aabcdeaef6c94cfb6	in the sandbox
`work/extracted/s821c01/Capture.png`	118.5 KB	5e4cbf6922ed4faf461db8e179dd59ac2e74d5e0f0dff3cc7ae30e1e6c0faeca	in the sandbox
`work/extracted/s821c01/Capture2.png`	397.8 KB	9fdd876c20af75637cf2e9a09bebf60e51b0a225634ed31918baea83e2008810	in the sandbox
`work/extracted/s821c01/Capture31231.lnk`	2.0 KB	896c4aea1fe03ed561b6cb7258eb3f1c7b8fda95e9eb6e83abd753e06ba994b1	in the sandbox
`work/extracted/s821c01/element/blobs/2`	463.1 KB	dffea9f39082c6280e99cbde3460510eb40d29eec35ad66ec3f73a7163b82867	in the sandbox
`work/extracted/s821c01/element/blobs/3`	554.4 KB	1eb8dd9916db068ffff2f3da07645f2ab537dc4dbf64e2e25c550070cee5aa96	in the sandbox
`work/extracted/s821c01/element/blobs/4`	628.0 KB	275386aea6e0505f845d48a4eed18d9ff906f035cc9c8e667dfa8cc31a460086	in the sandbox
`work/extracted/s821c01/element/blobs/5`	385.1 KB	5d3c3bd2275573482e8b89ea0315e190efe036c53104318557d97114050d6426	in the sandbox
`work/extracted/s821c01/element/blobs/6`	576.8 KB	4b2303f5194052c0c09a2ea85634daab3a1d4045e9b0f97f10767f921c050275	in the sandbox
`work/extracted/s821c01/element/blobs/7`	612.8 KB	e3e85a65058323490342db5e81f88c4a9dfe5b3df16298a7b91439b26bde658a	in the sandbox
`work/extracted/s821c01/element/blobs/8`	505.3 KB	e5eb79a032522fa473fe846a559e06079623498a30668264dd751c139dd587f6	in the sandbox
`work/extracted/s821c01/element/blobs/9`	485.2 KB	7b1b00ce24f2a4558d8f70c62183cbad159ddec2dd9ee2d9013c711b4fa389c2	in the sandbox
`work/extracted/s821c01/element/blobs/a`	532.4 KB	8f4e4c471110a64b8706af0908635710982698b9f3e76aa4e3c33d02aabf7032	in the sandbox
`work/extracted/s821c01/element/blobs/b`	506.8 KB	51eae62c3cb800b643901586db76193665845784b6e180cd59f3decd4e7fa6ad	in the sandbox
`work/extracted/s821c01/element/blobs/c`	637.2 KB	52fa877fc0b1e5739dcc9261a166e76ea4b03358bbe57889a2e5982809c5b1d8	in the sandbox
`work/extracted/s821c01/element/blobs/d`	225.0 KB	1e0e5e05b81e5a47480e043f758c5dd43db01f462c6b71298638ab21f9b4b9e0	in the sandbox
`work/extracted/s821c01/element/electron-config.json`	26 B	b879191fc75182bb2d2620afe16cb04948e87f6f041f1a75dea6acfc74de3f04	in the sandbox
`work/extracted/s821c01/element/events.db`	80.0 KB	b30cb8a470cd6843bc663854e3fa28d647752bae8d776c1dcff241af0ccbace2	in the sandbox
`work/extracted/s821c01/element/events.db-wal`	330.0 KB	d729da6f9d7d0486a6f6d8da16272cc4daf017ab32ecfa04f9987f664a3d9d9d	in the sandbox
`work/extracted/s821c01/element/idb_000098.ldb`	60.3 KB	6b3480b29be9a3fe6a912f37515d21904a6742443e42c156a49afc73f12f1999	in the sandbox
`work/extracted/s821c01/element/idb_000099.log`	980.1 KB	1952949f0ef31bd466d944cbead33456b12c4321d4a873651af9618e8c15ef21	in the sandbox
`work/extracted/s821c01/element/idb_000100.ldb`	1.8 MB	34e4f16d38785d35c969138b08f612902859c1985a72135b21b16497df36f6b9	in the sandbox
`work/extracted/s821c01/element/localstorage_000003.log`	4.5 KB	0b660482c5c01b479da0b155e365d0ca73dd9a8808e4615aa49fcb752486efa1	in the sandbox
`work/extracted/s821c01/itunes/files/keychain-backup.plist`	395.8 KB	245c954e3e02d951ff7d638dc5017597e831c229e43d0d9e74185bbbd4668102	in the sandbox
`work/extracted/s821c01/itunes/files/notes.sqlite`	140.0 KB	3555fa0200b9b815897cc00fe7b2f16d847780ea597cb6437a815bd736478bfd	in the sandbox
`work/extracted/s821c01/itunes/files/notes.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c01/itunes/files/notes.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c01/itunes/files/NoteStore.sqlite`	292.0 KB	f79f3df6a98a1c9350fe9b5c7f5f3bcb1c5ef3e1f300876934f159ff08670fd1	in the sandbox
`work/extracted/s821c01/itunes/files/NoteStore.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c01/itunes/files/NoteStore.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c01/itunes/files/Photos.sqlite`	1.9 MB	500bfb139713fe57e71f3d3ecffdd08bdc2aa06ecfffd58e3895e9dc2b74d595	in the sandbox
`work/extracted/s821c01/itunes/files/Photos.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c01/itunes/files/Photos.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c01/itunes/files/telegram.plist`	192 B	1ee0b5745a8fdca630cbd7e5fcead732f7198e21bdd6105c0560aaa1bdb1cb00	in the sandbox
`work/extracted/s821c01/itunes/Info.plist`	113.7 KB	f9a5a6a6baa1825c70bd147905e19c7640d623dc62326ed2dfe8abc3d6ec0ae0	in the sandbox
`work/extracted/s821c01/itunes/Manifest.db`	3.9 MB	26f6bb195dd71f045eee220d1a52b1a2fd04ff42206b6f4ff1962f3dbbbce832	in the sandbox
`work/extracted/s821c01/itunes/Manifest.db-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c01/itunes/Manifest.db-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c01/itunes/Manifest.plist`	112.8 KB	1393772f04beb6b9cba0c454c1b2d701a756b89372985b0e2305becf1b2d5a32	in the sandbox
`work/extracted/s821c01/ituneslib/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb`	4.0 KB	3d1e98365599c0aadf69ebddee20431cd8525432f9306c8b0e82a09f9ef2b76d	in the sandbox
`work/extracted/s821c01/ready.lnk`	1.9 KB	896ccde14d0e3ced8839b67a544a998f09c7977e67ccf18af8e0f16dc8c4e558	in the sandbox
`work/extracted/s821c01/registrymodifications.xcu`	189.4 KB	2fea8c94bf32904962707af202709db4d218824244805bbafa6471b4f3b3ef33	in the sandbox
`work/extracted/s821c01/sms/private/var/mobile/Library/SMS/sms.db`	288.0 KB	93099ce2ad3eb5fdbf41ad41c43e6828c191c119362e8278d8656ed12fb95788	in the sandbox
`work/extracted/s821c01/sms/private/var/mobile/Library/SMS/sms.db-shm`	32.0 KB	46af2ea017e322730310f0f9052c1be2fa9b2c053649da171fde1a94084d8647	in the sandbox
`work/extracted/s821c01/sms/private/var/mobile/Library/SMS/sms.db-wal`	587.5 KB	bd852d9189f60a941b2c70580f9f760df44c86b2df32cc081cdd770ad0c6461a	in the sandbox
`work/extracted/s821c01/Spending.xlsx.lnk`	474 B	032d86587cdd4d8188f7ccf88c0dae6fb5d81f8dc519aa79fb59272c74499aa2	in the sandbox
`work/extracted/s821c01/splitwise/private/var/mobile/Containers/Data/Application/E951DC58-CF30-4518-9482-3E076D89A20B/Library/Caches/com.Splitwise.SplitwiseMobile/Cache.db`	48.0 KB	52a89bf04cacb69b3d1ccddbddd1ddc9999e53a0c967ac333b202cb0c6fba9d6	in the sandbox
`work/extracted/s821c01/splitwise/private/var/mobile/Containers/Data/Application/E951DC58-CF30-4518-9482-3E076D89A20B/Library/Caches/com.Splitwise.SplitwiseMobile/Cache.db-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c01/splitwise/private/var/mobile/Containers/Data/Application/E951DC58-CF30-4518-9482-3E076D89A20B/Library/Caches/com.Splitwise.SplitwiseMobile/Cache.db-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c01/splitwise/private/var/mobile/Containers/Data/Application/E951DC58-CF30-4518-9482-3E076D89A20B/Library/Caches/com.Splitwise.SplitwiseMobile/fsCachedData/451CBB40-753F-4FBB-A569-F0B6DDAC56BF`	6.0 KB	8602dbddf3fd5fb9de93526e13fa1bafbe752af4403ff3a10d4e051f39009c24	in the sandbox
`work/extracted/s821c01/splitwise/private/var/mobile/Containers/Data/Application/E951DC58-CF30-4518-9482-3E076D89A20B/Library/Caches/com.Splitwise.SplitwiseMobile/fsCachedData/CA396F86-E7A8-4209-9F19-637CB2BCAD08`	5.3 KB	73f3adfb4389fbe4989c88054b1f1a73a9a298eff847b2507029dc234a452cb0	in the sandbox
`work/extracted/s821c01/splitwise/private/var/mobile/Containers/Data/Application/E951DC58-CF30-4518-9482-3E076D89A20B/Library/HTTPStorages/com.Splitwise.SplitwiseMobile/httpstorages.sqlite`	4.0 KB	b3f176fd152631e986aff7544248fc5be8e9d9ff55b80c11cfe240b09c2bd379	in the sandbox
`work/extracted/s821c01/splitwise/private/var/mobile/Containers/Data/Application/E951DC58-CF30-4518-9482-3E076D89A20B/Library/Preferences/com.Splitwise.SplitwiseMobile.plist`	8.3 KB	36926e9080770127b5f645f4aaaae39c725e88bc93a6e92a74e726c360712b16	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0003.HEIC/5003.JPG`	17.6 KB	028d2fcf53004d5ee467633d769a0e4450ad70483b34bd7e1673745e2c393518	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0004.HEIC/5003.JPG`	21.7 KB	f374d51bb358a8dbe70661fd33e97a2859007942c8005c653b9e0481cd7fc221	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0005.HEIC/5003.JPG`	17.9 KB	06ed22b8124ce9e3701b42ed18972ddf408f701169d8d6cde43863d0777af233	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0006.HEIC/5003.JPG`	24.3 KB	0465a9a6b8754b9b517e6dd1bffc40f57fad291a9e30689dde882b31f48e6312	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0007.HEIC/5003.JPG`	22.4 KB	56eb4f00d73cc6d3a6801bb027b44dff1e9360d0be8447bd29758f82ae9cf0ec	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0012.HEIC/5003.JPG`	41.5 KB	23e5cc07d21d12d51cb03c89c4c5e8754b8e1768b4a61e691b729eb5e8b60386	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0013.HEIC/5003.JPG`	44.3 KB	464d854db4172a26e6bd73ec2c9cf1d5d49d8c901b3a6ed4383e580383e73610	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0014.HEIC/5003.JPG`	41.7 KB	ff155a902609a855468dca5719777967a8cf19616cfd0b208e9608ad7262d8b2	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0015.HEIC/5003.JPG`	43.7 KB	8eb75962cc1e27339befc3569920c8f315e77003d79edaac2d02f0a7083b81bf	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0016.HEIC/5003.JPG`	44.1 KB	df6a280717fd13f8809abc513e9f9aac14b04a9783908fa8eb727d6c94ffd5f4	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0017.HEIC/5003.JPG`	44.4 KB	4fcccb07d8fa7614e4317758d323ba07d96713096c53f5408677d2ef092aaa90	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0018.HEIC/5003.JPG`	44.6 KB	00d7835ac0c252b2e4372f8b4a3401350a9e8dfad81e4c496cd282cb4d581164	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0019.HEIC/5003.JPG`	44.4 KB	f5bb20759e4395c1f42cc32800534ca8c806d26f57a51f300c842291e841943a	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0020.HEIC/5003.JPG`	43.2 KB	2a9a004b4dc3678952999db42740a392d358fd896c01b16ea5e37fbe76e7385f	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0021.HEIC/5003.JPG`	40.7 KB	5bc02bb79ace63cf78f3c6a6faa8ec3d586ec33312c990ddfc1559e0d9330445	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0022.HEIC/5003.JPG`	43.2 KB	2be74e9a90fd13afa3586890f694be9295e1367f491af165d7564e8dbd13588a	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0023.HEIC/5003.JPG`	44.0 KB	f3825b4e7ec8dfcc1e8c5cfcf1fbc802f288ac130b7414c8ecc844c9e82dd4b9	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0024.HEIC/5003.JPG`	42.5 KB	de178c02a76df81eb91e716007c72a08f5728b202b4c37194281fcffc8aabdd4	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0025.HEIC/5003.JPG`	40.3 KB	25ef435b259fc7d7f21328d92028b775aa20cd1299733db5c94491cfc594e27a	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0026.HEIC/5003.JPG`	28.1 KB	d7f9f1d3bc56c16204da6428d9ffa82c71303594158d7ae90eac76f6392e1faa	in the sandbox
`work/extracted/s821c01/thumbs/private/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0036.HEIC/5003.JPG`	10.1 KB	5818c65ac43d82b2565f7eeacb65e4d4054ea48a8ffbe8e78fe6e5c9910129f6	in the sandbox
`work/extracted/s821c01/tiktok/private/var/mobile/Containers/Data/Application/25D6FC89-3F45-4C53-8502-110948744484/Library/AWEStorage/UnifyStorage.sqlite`	9.4 MB	4809ccb83a1dd7b2cdd297420c78333bd11864e5854b7033b51884ad4628b819	in the sandbox
`work/extracted/s821c01/tiktok/private/var/mobile/Containers/Data/Application/25D6FC89-3F45-4C53-8502-110948744484/Library/Preferences/com.zhiliaoapp.musically.plist`	163.4 KB	70260524bda15e732123f9f08ca4045dbe56c5cf283afe71178441e8b0308f21	in the sandbox
`work/extracted/s821c01/Vault_Y.lnk`	349 B	a3a5662c961299c12cb1bfbffaf2a96570662c40f638fb165e3aa8b65c8aa920	in the sandbox
`work/extracted/s821c01/vault/vault_head.bin`	80.0 KB	4f3cc5b009114ebe367d9e5f5e29878bca2656e4c8a81a3d791ec29f39891e4c	in the sandbox
`work/extracted/s821c02/el/electron-config.json`	26 B	b879191fc75182bb2d2620afe16cb04948e87f6f041f1a75dea6acfc74de3f04	in the sandbox
`work/extracted/s821c02/el/events.db`	80.0 KB	2f1883e3c6ce185f319169d01523a2d331418f3e74225ea2d2916eef27a06800	in the sandbox
`work/extracted/s821c02/el/idb/103085.bin`	485.2 KB	7b1b00ce24f2a4558d8f70c62183cbad159ddec2dd9ee2d9013c711b4fa389c2	in the sandbox
`work/extracted/s821c02/el/idb/103153.bin`	554.4 KB	1eb8dd9916db068ffff2f3da07645f2ab537dc4dbf64e2e25c550070cee5aa96	in the sandbox
`work/extracted/s821c02/el/idb/103154.bin`	576.8 KB	4b2303f5194052c0c09a2ea85634daab3a1d4045e9b0f97f10767f921c050275	in the sandbox
`work/extracted/s821c02/el/idb/103155.bin`	628.0 KB	275386aea6e0505f845d48a4eed18d9ff906f035cc9c8e667dfa8cc31a460086	in the sandbox
`work/extracted/s821c02/el/idb/103186.bin`	463.1 KB	dffea9f39082c6280e99cbde3460510eb40d29eec35ad66ec3f73a7163b82867	in the sandbox
`work/extracted/s821c02/el/idb/103195.bin`	612.8 KB	e3e85a65058323490342db5e81f88c4a9dfe5b3df16298a7b91439b26bde658a	in the sandbox
`work/extracted/s821c02/el/idb/103196.bin`	532.4 KB	8f4e4c471110a64b8706af0908635710982698b9f3e76aa4e3c33d02aabf7032	in the sandbox
`work/extracted/s821c02/el/idb/103197.bin`	385.1 KB	5d3c3bd2275573482e8b89ea0315e190efe036c53104318557d97114050d6426	in the sandbox
`work/extracted/s821c02/el/idb/103220.bin`	506.8 KB	51eae62c3cb800b643901586db76193665845784b6e180cd59f3decd4e7fa6ad	in the sandbox
`work/extracted/s821c02/el/idb/103221.bin`	637.2 KB	52fa877fc0b1e5739dcc9261a166e76ea4b03358bbe57889a2e5982809c5b1d8	in the sandbox
`work/extracted/s821c02/el/idb/103226.bin`	225.0 KB	1e0e5e05b81e5a47480e043f758c5dd43db01f462c6b71298638ab21f9b4b9e0	in the sandbox
`work/extracted/s821c02/el/idb/34898.bin`	505.3 KB	e5eb79a032522fa473fe846a559e06079623498a30668264dd751c139dd587f6	in the sandbox
`work/extracted/s821c02/el/meta.json`	1.8 KB	9edaf066d50b31ac3133ad0da621160e42d93bf4bde6b2dbf88ac5c591a66da1	in the sandbox
`work/extracted/s821c02/ff/cookies.sqlite`	512.0 KB	5039a0cba1327c3868c588bfe6fe06f9fdc57f6340d48c8e1d0eaaa34fa1ab14	in the sandbox
`work/extracted/s821c02/ff/formhistory.sqlite`	256.0 KB	e6bc05b01ef9ab2198a4c2187a42f7e5c58ac79134e723f9f058627fa4a3d5a4	in the sandbox
`work/extracted/s821c02/ff/places.sqlite`	5.0 MB	913c25074e7e9a34f5fd0fb7f64a763f177148b20f07638aabcdeaef6c94cfb6	in the sandbox
`work/extracted/s821c02/lnks/776AR-04U.PDF.lnk`	474 B	4c5b7ff1666e9a38f9429d6e16ed191624514880577d22f7adc6b7613809fb69	in the sandbox
`work/extracted/s821c02/lnks/B500_ATM.lnk`	567 B	c27dd34f5845c1433c057dbea5ccd567e6bca5949c0020a6c7765822de1a530c	in the sandbox
`work/extracted/s821c02/lnks/BitLocker_Recovery.lnk`	2.1 KB	8564021f6f898a485fa5badfdb2aa0420d5f12034ca817b1039756de557c95b7	in the sandbox
`work/extracted/s821c02/lnks/ready.lnk`	1.9 KB	896ccde14d0e3ced8839b67a544a998f09c7977e67ccf18af8e0f16dc8c4e558	in the sandbox
`work/extracted/s821c02/lnks/Spending.xlsx.lnk`	474 B	032d86587cdd4d8188f7ccf88c0dae6fb5d81f8dc519aa79fb59272c74499aa2	in the sandbox
`work/extracted/s821c02/lnks/Vault_Y.lnk`	349 B	a3a5662c961299c12cb1bfbffaf2a96570662c40f638fb165e3aa8b65c8aa920	in the sandbox
`work/extracted/s821c02/lo/Module1.xba`	1.1 KB	b434faf21386064e2e81af758f307ae8bea72c0cb6c8510d55b1bc1bb38f8612	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0002.PNG`	548.9 KB	4c334a4ec37c067df411c7efe5c7c1ceb6cb55960ac9ac1b5c01190c92706ca6	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0008.PNG`	1.0 MB	0521a07dfe9e85b3afb3506550b84bc1f79678e7d91229d094ce384155f8fc44	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0009.JPG`	35.7 KB	59a88579efaecf29dc2451e07bc22e3543faca3f492530d473ddd9aadd88c820	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0010.JPG`	34.1 KB	f27f3c0d3ce343a1e9bf6fe8e982a97a38a84fff31ba8138028dfb41ea7d7f99	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0011.PNG`	1.9 MB	cb2f54b58e68808d40841ffa657fc7c3557a34fef057684a33d6979a7abfc5e1	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0027.JPG`	28.8 KB	281c8f1da11f2fe4ce61143ddf0849ce4b15886a65b538260528a07835198b10	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0028.JPG`	24.0 KB	36b6842bd40fd1f19db90b64fc271e99e67054b84d94a0ae0616bc314cf09989	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0029.WEBP`	71.4 KB	89ecbc006da076a961ad25afcf3f28a5ea7315ea5efe081d0eeb817d804cc84e	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0030.WEBP`	71.4 KB	89ecbc006da076a961ad25afcf3f28a5ea7315ea5efe081d0eeb817d804cc84e	in the sandbox
`work/extracted/s821c02/photos/private/var/mobile/Media/DCIM/100APPLE/IMG_0032.PNG`	85.5 KB	2d52b1ffbbfdddb856db9bd8e288f77dda382ecc1c2667e7f754eed365d66906	in the sandbox
`work/extracted/s821c02/pic/Capture.png`	118.5 KB	5e4cbf6922ed4faf461db8e179dd59ac2e74d5e0f0dff3cc7ae30e1e6c0faeca	in the sandbox
`work/extracted/s821c02/pic/Capture2.png`	397.8 KB	9fdd876c20af75637cf2e9a09bebf60e51b0a225634ed31918baea83e2008810	in the sandbox
`work/extracted/s821c02/powder/powder.pref`	437 B	fc14b1e02ee607e91caf3ee5cd5c43a5b201e53d51ddce75377694b38469205e	in the sandbox
`work/extracted/s821c02/reg/NTUSER.DAT`	1.3 MB	feeb91311dde4e5d14691a3740925d4b2252033aa71bf86003a20e1c87fd7a3f	in the sandbox
`work/extracted/s821c03/iphone/accounts/private/var/mobile/Library/Accounts/Accounts3.sqlite`	220.0 KB	47ae70b9445b566b7a658c14366f0ef8945f172f2a6a66ff59f60b1b19a4ae50	in the sandbox
`work/extracted/s821c03/iphone/accounts/private/var/mobile/Library/Accounts/Accounts3.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/iphone/accounts/private/var/mobile/Library/Accounts/Accounts3.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/iphone/addressbook/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb`	4.0 KB	3d1e98365599c0aadf69ebddee20431cd8525432f9306c8b0e82a09f9ef2b76d	in the sandbox
`work/extracted/s821c03/iphone/addressbook/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/iphone/addressbook/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/accounts-metadata/atomic-state`	2.4 KB	06e70c26b61d9273ac5cd5aac7745c9a919e3701023223cb79208472ddabc07a	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/accounts-metadata/db/db_sqlite`	4.0 KB	4b0f372cf45fcdb0a93e0de44d25c2a6334e7f89b94cc3e4c4e0588f89314fe2	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/accounts-metadata/spotlight/p:36891850763/avatar.png`	34.5 KB	9c23adc61d76fc42408bee49cc91002b371457620a60de4aae890cb070bad2a4	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/accounts-metadata/spotlight/p:36891850763/data.json`	170 B	3d4065574e5b3faf04e05a89cfd505a32e48f514c6c8b3c41049403370c45332	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Containers/Shared/AppGroup/AF67BA79-B4B6-4F89-AD78-9054620F3322/NoteStore.sqlite`	292.0 KB	1d9d7ae5f11d86bf253b011d4dd894dc06b7f31614dae4d546de8eac43540f8c	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Containers/Shared/AppGroup/AF67BA79-B4B6-4F89-AD78-9054620F3322/NoteStore.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Containers/Shared/AppGroup/AF67BA79-B4B6-4F89-AD78-9054620F3322/NoteStore.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb`	4.0 KB	3d1e98365599c0aadf69ebddee20431cd8525432f9306c8b0e82a09f9ef2b76d	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/Notes/notes.sqlite`	140.0 KB	29dfe2b4bfb8d1753c3f04e52a1e61459d265ac45031c2b4c6ffe88c19a96e76	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/Notes/notes.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/Notes/notes.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/PersonalizationPortrait/Contacts/me_card.pb`	120 B	0522c30b410b7a0b7aa9fc46f137bb57e7ad5818198dba8fc2a8568fe1e56857	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/Safari/History.db`	132.0 KB	e6659ab7ab81baec31821d98071d9d25237329fb08127f4d286173d03915d5e3	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/Safari/History.db-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Library/Safari/History.db-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Media/PhotoData/Photos.sqlite`	2.2 MB	f12447874e81e402a46b09d896fc2e22713fa4f1554e1fd05452acf4cee2350b	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Media/PhotoData/Photos.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/iphone/private/var/mobile/Media/PhotoData/Photos.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/iphone/private/var/preferences/com.apple.wifi.known-networks.plist`	1.3 KB	cd0e19bb93e2787f00ac9112ac66361f3e1318a58621ba27c9091c5f7a6347ca	in the sandbox
`work/extracted/s821c03/iphone/private/var/preferences/SystemConfiguration/com.apple.wifi-networks.plist`	42 B	9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1	in the sandbox
`work/extracted/s821c03/iphone/private/var/preferences/SystemConfiguration/com.apple.wifi.plist`	1.2 KB	473d986e6bc4dfe0fb4bbe075fa2cc3a55d406574efbfa2670f90b6db523bbb4	in the sandbox
`work/extracted/s821c03/iphone/private/var/root/Library/Caches/locationd/cache.plist`	8.7 KB	37b9023a66c6aaab0b19cf333ee05dc6a6e4b1589fc752e4f216e224ebf5cf40	in the sandbox
`work/extracted/s821c03/iphone/sms/private/var/mobile/Library/SMS/sms.db`	288.0 KB	93099ce2ad3eb5fdbf41ad41c43e6828c191c119362e8278d8656ed12fb95788	in the sandbox
`work/extracted/s821c03/iphone/sms/private/var/mobile/Library/SMS/sms.db-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/iphone/sms/private/var/mobile/Library/SMS/sms.db-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/iphone/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/account-112545592466388074/postbox/db/db_sqlite`	7.2 MB	040304c487e41f4f64a24d5777662488b0e78cad0c4f69d1550bdd29f8bffcc1	in the sandbox
`work/extracted/s821c03/iphone/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/account-112545592466388074/postbox/db/db_sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/iphone/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/account-112545592466388074/postbox/db/db_sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/iphone/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/accounts-metadata/db/db_sqlite`	4.0 KB	4b0f372cf45fcdb0a93e0de44d25c2a6334e7f89b94cc3e4c4e0588f89314fe2	in the sandbox
`work/extracted/s821c03/iphone/tg_strings.txt`	688.0 KB	1fc4fc7f736934ae6dc97cb92885b09eb4dd5ac432116d1286533cbbe9ec34c4	in the sandbox
`work/extracted/s821c03/laptop/backup_addressbook.sqlitedb`	300.0 KB	415108c843d8a2a1eb8a9669d16c396dab8d8fa564b9c14a0762147af62de488	in the sandbox
`work/extracted/s821c03/laptop/backup_addressbook.sqlitedb-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/laptop/backup_addressbook.sqlitedb-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/laptop/Capture2.png`	397.8 KB	9fdd876c20af75637cf2e9a09bebf60e51b0a225634ed31918baea83e2008810	in the sandbox
`work/extracted/s821c03/laptop/elem_store1`	348 B	b87a8272f5281942fa933d9f42b01494d81f4478121f3606349528b0c5675853	in the sandbox
`work/extracted/s821c03/laptop/elem_store2`	348 B	da1b0af63c58e8648add11288f95fe7b351568bb099387930c70699f52c01501	in the sandbox
`work/extracted/s821c03/laptop/elem_store3`	249 B	3de681d73263b910f03e6f75f915e86547d753df21ea9c7f7beabb2dec25fff6	in the sandbox
`work/extracted/s821c03/laptop/events.db`	80.0 KB	b30cb8a470cd6843bc663854e3fa28d647752bae8d776c1dcff241af0ccbace2	in the sandbox
`work/extracted/s821c03/laptop/Manifest.db`	3.9 MB	26f6bb195dd71f045eee220d1a52b1a2fd04ff42206b6f4ff1962f3dbbbce832	in the sandbox
`work/extracted/s821c03/laptop/Manifest.db-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/laptop/Manifest.db-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/laptop/places.sqlite`	5.0 MB	913c25074e7e9a34f5fd0fb7f64a763f177148b20f07638aabcdeaef6c94cfb6	in the sandbox
`work/extracted/s821c03/laptop/places.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c03/laptop/places.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c03/laptop/SOFTWARE`	72.5 MB	ca6be5578b78fa362a871f52e344b1ebc3de2c11ca782b2a6aa020e7276d35d8	in the sandbox
`work/extracted/s821c03/laptop/vault.vhdx`	580.0 MB	877fff02e22383cccd511e9e94a77c83f7acbcc789e0ed9d2343e1c89234da3f	in the sandbox
`work/extracted/s821c04/776AR-04U.PDF.lnk`	474 B	4c5b7ff1666e9a38f9429d6e16ed191624514880577d22f7adc6b7613809fb69	in the sandbox
`work/extracted/s821c04/B500 ATM Technical Documentation.pdf.lnk`	567 B	c27dd34f5845c1433c057dbea5ccd567e6bca5949c0020a6c7765822de1a530c	in the sandbox
`work/extracted/s821c04/BitLocker_Recovery_Key.lnk`	2.1 KB	8564021f6f898a485fa5badfdb2aa0420d5f12034ca817b1039756de557c95b7	in the sandbox
`work/extracted/s821c04/Capture_ocr.txt`	237 B	e292051feea1e2599886ab3622d27483564558ffa7ac5fa4b5a82d669d91ff02	in the sandbox
`work/extracted/s821c04/Capture.png`	118.5 KB	5e4cbf6922ed4faf461db8e179dd59ac2e74d5e0f0dff3cc7ae30e1e6c0faeca	in the sandbox
`work/extracted/s821c04/Capture2_ocr.txt`	98 B	0808d076bf0c985b45d54720e09ece188d5783ae8a66fe730470cc2638a4a5ca	in the sandbox
`work/extracted/s821c04/Capture2.png`	397.8 KB	9fdd876c20af75637cf2e9a09bebf60e51b0a225634ed31918baea83e2008810	in the sandbox
`work/extracted/s821c04/Edge_History.db`	256.0 KB	8fc410100297f3c83d7ed466e2fe21794c8f68c210c253da48194e59cc8013ac	in the sandbox
`work/extracted/s821c04/Edge_Login_Data.db`	56.0 KB	8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259	in the sandbox
`work/extracted/s821c04/Element_Databases.db`	28.0 KB	08eb1696d053f29f3e063ec63fc6087d69836a7a9b3f742d2ccc5799c2c5363b	in the sandbox
`work/extracted/s821c04/Element_events.db`	80.0 KB	b30cb8a470cd6843bc663854e3fa28d647752bae8d776c1dcff241af0ccbace2	in the sandbox
`work/extracted/s821c04/firefox_cookies.sqlite`	512.0 KB	5039a0cba1327c3868c588bfe6fe06f9fdc57f6340d48c8e1d0eaaa34fa1ab14	in the sandbox
`work/extracted/s821c04/firefox_cookies.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c04/firefox_cookies.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c04/firefox_places.sqlite`	5.0 MB	913c25074e7e9a34f5fd0fb7f64a763f177148b20f07638aabcdeaef6c94cfb6	in the sandbox
`work/extracted/s821c04/firefox_places.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c04/firefox_places.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c04/iphone/private/var/mobile/Library/Notes/notes.sqlite`	140.0 KB	29dfe2b4bfb8d1753c3f04e52a1e61459d265ac45031c2b4c6ffe88c19a96e76	in the sandbox
`work/extracted/s821c04/iphone/private/var/mobile/Library/Notes/notes.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c04/iphone/private/var/mobile/Library/Notes/notes.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c04/SOFTWARE`	72.5 MB	ca6be5578b78fa362a871f52e344b1ebc3de2c11ca782b2a6aa020e7276d35d8	in the sandbox
`work/extracted/s821c04/SOFTWARE_hive`	72.5 MB	ca6be5578b78fa362a871f52e344b1ebc3de2c11ca782b2a6aa020e7276d35d8	in the sandbox
`work/extracted/s821c04/Spending.xlsx.lnk`	474 B	032d86587cdd4d8188f7ccf88c0dae6fb5d81f8dc519aa79fb59272c74499aa2	in the sandbox
`work/extracted/s821c04/tg_leveldb_log`	204.9 KB	f398066a34d7f36c64eca5c08e3ecda149f53d71fa09b00d9662ec35c40d0c24	in the sandbox
`work/extracted/s821c04/Vault_Y.lnk`	349 B	a3a5662c961299c12cb1bfbffaf2a96570662c40f638fb165e3aa8b65c8aa920	in the sandbox
`work/extracted/s821c04/vault.vhdx`	580.0 MB	877fff02e22383cccd511e9e94a77c83f7acbcc789e0ed9d2343e1c89234da3f	in the sandbox
`work/extracted/s821c05/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/account-112545592466388074/postbox/db/db_sqlite`	7.2 MB	040304c487e41f4f64a24d5777662488b0e78cad0c4f69d1550bdd29f8bffcc1	in the sandbox
`work/extracted/s821c05/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/account-112545592466388074/postbox/db/db_sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c05/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/account-112545592466388074/postbox/db/db_sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c05/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/accounts-metadata/db/db_sqlite`	1.1 MB	0aeb3b3dd1e8ab2cb299033f2dd41b2f2295353d6f3daf3b46d90a0a586e53d2	in the sandbox
`work/extracted/s821c05/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/accounts-metadata/db/db_sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	in the sandbox
`work/extracted/s821c05/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/accounts-metadata/db/db_sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c05/telegram/private/var/mobile/Containers/Shared/AppGroup/A667456A-6F8F-48C7-A8CF-37EFCC6BD644/telegram-data/accounts-metadata/spotlight/p:36891850763/data.json`	170 B	3d4065574e5b3faf04e05a89cfd505a32e48f514c6c8b3c41049403370c45332	in the sandbox
`work/extracted/s821c06/err1.txt`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c06/err2.txt`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c06/err3.txt`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c06/err4.txt`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c06/err5.txt`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c06/err6.txt`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c06/err7.txt`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	in the sandbox
`work/extracted/s821c06/NTUSER.DAT`	1.3 MB	feeb91311dde4e5d14691a3740925d4b2252033aa71bf86003a20e1c87fd7a3f	in the sandbox
`work/extracted/s821c06/places.sqlite`	5.0 MB	913c25074e7e9a34f5fd0fb7f64a763f177148b20f07638aabcdeaef6c94cfb6	in the sandbox
`work/extracted/s821c06/Powder.exe`	6.4 MB	0c67ea27c37b2b5382a8420ec6f4adf1a777890ef8327a37fbdf4c3e5dfaf181	in the sandbox
`work/extracted/s821c06/powder.zip`	2.9 MB	37e0915aaf29d38fd28067d0d90e54c48ed1f8a00a095e31a375eba913ec82a3	in the sandbox
`work/extracted/s821c06/SAM`	64.0 KB	9a766022db1ee7768ad50aef130a85403f520d0ac829af8eef94a2db8ed14fcd	in the sandbox
`work/extracted/s821c06/SOFTWARE`	72.5 MB	ca6be5578b78fa362a871f52e344b1ebc3de2c11ca782b2a6aa020e7276d35d8	in the sandbox
`work/extracted/s821c06/SYSTEM`	11.0 MB	c22c5ecd3baca745d382fcfaddc03860a49319910fc12172d7e59187c6f35bc9	in the sandbox
`work/extracted/s821c08/vault.vhdx`	580.0 MB	877fff02e22383cccd511e9e94a77c83f7acbcc789e0ed9d2343e1c89234da3f	in the sandbox
`work/flags.md`	3.8 KB	c4740c263871ad64069687c140f1078411aed7634c373b807139a092dc6d186f	packaged
`work/report.md`	7.8 KB	86108db9478003f92b08313fdecef505bc51b61feed892c60b7768f352f893f0	packaged
`work/s821c00/q1_q2.md`	1.7 KB	4343e7818b8d75257f4edd087c71968019e6516fc3b4cb9dd70079c359e70936	packaged
`work/s821c00/secudecrypt.bin`	3.4 KB	6299403b05752e3cd35c9ee92e0d55c4191dfcfaf164f0505fa9acf1c8c846ba	packaged
`work/s821c00/secuencrypt.bin`	2.9 KB	9701a6f328e6bb3b7a22b83429de5f689aa48315147b8f59bb4ef87ae6dde950	packaged
`work/s821c01/browser/edge_History`	256.0 KB	8fc410100297f3c83d7ed466e2fe21794c8f68c210c253da48194e59cc8013ac	packaged
`work/s821c01/browser/places.sqlite`	5.0 MB	913c25074e7e9a34f5fd0fb7f64a763f177148b20f07638aabcdeaef6c94cfb6	packaged
`work/s821c01/browser/places.sqlite-shm`	32.0 KB	fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb	packaged
`work/s821c01/browser/places.sqlite-wal`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	packaged
`work/s821c01/element/events.db`	80.0 KB	2f1883e3c6ce185f319169d01523a2d331418f3e74225ea2d2916eef27a06800	packaged
`work/s821c02/tg_messages.txt`	28.5 KB	3a83d3466ee673bc44ce9b243ef4940ac559aa03e98033925042eb4ad590353c	packaged
`work/s821c05/postbox.strings`	1.2 MB	67a94a906dd71229a9a3aa7cb5bd88f330587fc092826fcca69328ab5152b9b9	packaged
`work/s821c05/tarfilelist.txt`	16.9 MB	4d3cb44a6c1fe4997f39392841eb7039b495fe5e8e916ccf0982d121fabab0e6	packaged
`work/s821c05/tarlist.err`	0 B	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	packaged
`work/s821c08/776AR-04U.PDF.lnk`	474 B	4c5b7ff1666e9a38f9429d6e16ed191624514880577d22f7adc6b7613809fb69	packaged
`work/s821c08/B500_ATM_Technical_Documentation.pdf.lnk`	567 B	c27dd34f5845c1433c057dbea5ccd567e6bca5949c0020a6c7765822de1a530c	packaged
`work/s821c08/BitLocker_Recovery_Key.lnk`	2.1 KB	8564021f6f898a485fa5badfdb2aa0420d5f12034ca817b1039756de557c95b7	packaged
`work/s821c08/Capture.png`	118.5 KB	5e4cbf6922ed4faf461db8e179dd59ac2e74d5e0f0dff3cc7ae30e1e6c0faeca	packaged
`work/s821c08/Capture2.png`	397.8 KB	9fdd876c20af75637cf2e9a09bebf60e51b0a225634ed31918baea83e2008810	packaged
`work/s821c08/Capture31231.lnk`	2.0 KB	896c4aea1fe03ed561b6cb7258eb3f1c7b8fda95e9eb6e83abd753e06ba994b1	packaged
`work/s821c08/Edge_History.db`	256.0 KB	8fc410100297f3c83d7ed466e2fe21794c8f68c210c253da48194e59cc8013ac	packaged
`work/s821c08/ext_manifest.json`	2.3 KB	db3991c5788fc6968df25180898ef42ad974192dfe0aed4e12969219a1eb8565	packaged
`work/s821c08/firefox_places.sqlite`	5.0 MB	913c25074e7e9a34f5fd0fb7f64a763f177148b20f07638aabcdeaef6c94cfb6	packaged
`work/s821c08/NTUSER.DAT`	1.3 MB	feeb91311dde4e5d14691a3740925d4b2252033aa71bf86003a20e1c87fd7a3f	packaged
`work/s821c08/ready.lnk`	1.9 KB	896ccde14d0e3ced8839b67a544a998f09c7977e67ccf18af8e0f16dc8c4e558	packaged
`work/s821c08/Spending.xlsx.lnk`	474 B	032d86587cdd4d8188f7ccf88c0dae6fb5d81f8dc519aa79fb59272c74499aa2	packaged
`work/s821c08/tg/000003.log`	204.9 KB	f398066a34d7f36c64eca5c08e3ecda149f53d71fa09b00d9662ec35c40d0c24	packaged
`work/s821c08/tg/blob3`	438.6 KB	9bf3bfd3a432ce0f295b13c8d9c82766c7f1930aa56a36dc000c209764d3fbd2	packaged
`work/s821c08/tg/blob6`	596.2 KB	44617808b089d9257b5c6314a9aa7ca3eb95aaf42468100d38f05156daffd74c	packaged
`work/s821c08/tg/blob7`	89.9 KB	beca481aa299c4ceac05db49dd725571b382a62b02ddeef76da69cfdbf67c12e	packaged
`work/s821c08/UsrClass.dat`	3.5 MB	fc40d91017e39e728700c34b6383e5a4e68e90b9ec9e3f813fc129d55a28d75b	packaged
`work/s821c08/VaultY.lnk`	349 B	a3a5662c961299c12cb1bfbffaf2a96570662c40f638fb165e3aa8b65c8aa920	packaged
`work/timeline.md`	6.4 KB	e63f2449c3d27e0ef8ca4d7f768ae001de75ec41e1871e67dc9e23b5ffe4a2bd	packaged

323 files, 2.2 GB in total; 35.4 MB of that travels with the package.

Files marked in the sandbox are under work/extracted/ and work/quarantine/. That material came out of the evidence and may be live, so the package does not carry it. It is hashed here, which is what lets a reader verify a copy obtained another way.

Limitations

60 tool calls failed or were refused during the run; they are in trace/events.jsonl.
This document reports what the swarm recorded. An artefact nobody opened is not evidence of absence, and the trace is the record of what was actually read.

Chain of custody

Item	Recorded
Case	BELKACTF6
Examiner	Halil Ozturkci
Tool	DFIR Swarm 0.3.0
Run	s821c
Started	2026-09-20T18:03:46Z
Ended	2026-09-20T18:54:17.540Z
Sandbox	/Users/halilozturkci/DFIR/dfirswarm-runs/s821c
Evidence	8 file(s), 13.5 GB, from /Users/halilozturkci/DFIR/SwarmInputs/belkactf6
Evidence intact at the end	yes, 8 checked by s821c02 at 2026-09-20T18:54:27.673Z
Network	netguard allowlist not kept; the proxy log shows it allowed 127.0.0.1:1234, api.deepseek.com:443, api.openai.com:443, halilozturkci-startup-resource.services.ai.azure.com:443, nominatim.openstreetmap.org:443
Ledger	57 entries (21 events, 11 indicators, 25 findings)
Trace	2287 tool calls

The swarm's own report (report.md)

Reproduced verbatim from work/report.md, sha256 86108db9478003f92b08313fdecef505bc51b61feed892c60b7768f352f893f0. Its headings are demoted so this document keeps one outline; nothing else is changed.

BELKACTF6 Report

_Seeded by s821c07 as the shared final report scaffold. Replace placeholders with final evidence-backed prose and keep citations specific (path, inode, query, record id, or command). Cite ledger/ledger.md where a conclusion is already recorded there._

1. What is the Apple ID used on the imaged iPhone?

Answer: billthemegakill@icloud.com

Evidence: private/var/mobile/Library/Accounts/Accounts3.sqlite (ZACCOUNT / ZACCOUNTPROPERTY), recorded in ledger/ledger.md findings #6 and #18.

2. What is the iPhone owner's full name?

Answer: William Phorger

Evidence: private/var/mobile/Library/PersonalizationPortrait/Contacts/me_card.pb; private/var/mobile/Library/AddressBook/AddressBook.sqlitedb (ABPerson, ABStore.MeIdentifier), recorded in ledger/ledger.md findings #5 and #17.

3. Which Telegram accounts did the owner discuss shady stuff with?

Answer: @diddyflowers, @locknload771, @Sm00thOperat0r, @JesusStreeton1999

Evidence: Telegram iOS postbox database account-112545592466388074/postbox/db/db_sqlite under work/extracted/s821c05/telegram/...; peer records from t2 and message content from t7 tie the owner's shady discussions to these accounts. See ledger/ledger.md finding #35 and IOC #34. Owner self-handles @megakilley / @billthemegakill and bot @prochefbakerbot were excluded from the final answer.

4. Where does William live?

Answer: 38.5924436,-90.057325

Evidence: private/var/root/Library/Caches/locationd/consolidated.db (GeoFences, Reminders geofence row for com.apple.reminders) gives latitude 38.5924436, longitude -90.057325, distance 114. Supporting context comes from private/var/preferences/com.apple.wifi.known-networks.plist (home Wi-Fi TWR9) and reverse-geocoding to Hillslope Drive / Hilltop / East Saint Louis, IL 62203. See ledger/ledger.md finding #42. Confidence is medium until a house number or more specific address is recovered.

5. What is the username of the laptop user?

Answer: phorger

Evidence: Users/phorger; Users/phorger/NTUSER.DAT (inode 101611-128-4), recorded in ledger/ledger.md finding #3.

6. What is the amount of William's first take in April?

Answer: _pending_

Evidence: likely gated on Y:\Spending.xlsx inside the recovered/confirmed container (ledger/ledger.md finding #19). Current unblocking lead: ledger/ledger.md finding #36 / IOC #37 record a BitLocker recovery key recovered from iPhone Notes; laptop peers need to confirm whether it unlocks the Vault VHDX.

7. Where did the gang go to celebrate their success together in March?

Answer: _Hypothesis:_ a downtown St. Louis bar/restaurant (exact venue name and coordinates unresolved; LAARI ADA St. Louis is the strongest current OCR lead).

Evidence: Telegram says, "crash that bar downtown tomorrow night," and laptop Capture2.png shows an Airbnb charge on 2024-03-26 and a LAARI ADA St. Louis debit on 2024-03-27. Splitwise did not preserve the venue name. This remains low confidence until a venue name or coordinates are recovered from vault, browser, or chat artefacts.

8. Which file does the guy keep his encrypted container in?

Answer: C:\Users\phorger\Documents\desktop.ini:vault.vhdx

Evidence: istat/icat on inode 102124-128-4; Vault (Y).lnk; Y:\B500 ATM Technical Documentation.pdf; Y:\Spending.xlsx; Y:\776AR-04U.PDF; recorded in ledger/ledger.md finding #19.

9. Which luxurious item did Phorger put his laundered money into?

Answer: _pending_

Evidence: likely tied to Y:\776AR-04U.PDF and/or other vault contents.

10. Which concert were Phorger and his girlfriend planning to attend in May?

Answer: _Hypothesis:_ Magic Mandrake, [venue unresolved], [city unresolved]

Evidence: Telegram chats discuss May honeymoon/vacation plans with Drew, and the string Magic Mandrake appears in Telegram database strings. No ticket, venue, or city was recovered from the accessible artefacts outside the locked vault / Element path, so this remains low confidence.

11. What's the name of the person who designed the print template for the bills?

Answer: _Hypothesis:_ Drew [last name unknown]

Evidence: Telegram identifies William's girlfriend as @diddyflowers / Dee 🌸, and chats tie Drew to bill-template design work. However, no surname was recovered from Telegram, Notes, AddressBook, or the accessible laptop artefacts, so this remains low confidence and format-incomplete.

12. Where is the makeshift lab where they printed the cash located?

Answer: _Hypothesis:_ William's uncle's garage (street address unresolved)

Evidence: Telegram indicates the print lab is a garage on William's uncle's property. The lab address was not present in the 13 decoded Chase secret-chat blobs and was not recovered from the accessible iPhone/laptop artefacts outside the locked vault / Element path, so this remains low confidence and not yet in the requested full-address format.

13. What is the precise moment their largest printing batch was completed?

Answer: _pending_

Evidence: pending print-workflow timestamps.

14. What's the printer model they used to print money?

Answer: _Hypothesis:_ not recovered; William said the details were sent separately

Evidence: Telegram between William and Max says printer details would be sent separately, but no printer model was recovered from the accessible Telegram/iPhone/laptop artefacts outside the locked vault / Element path. This remains low confidence / unresolved.

15. Which ATM did Phorger test his bills on recently?

Answer: _Hypothesis:_ the "stubborn machine" linked at https://bit.ly/3VKt3er (bank and street unresolved)

Evidence: Telegram the.party chat records an ATM complaint with https://bit.ly/3VKt3er; Safari on the iPhone shows atm booth doesnt open / locked myself in atm booth on 2024-04-03, and the same day includes a dark IMG_0036.PNG consistent with an ATM vestibule. The exact bank/street answer likely sits in Y:\B500 ATM Technical Documentation.pdf or other vault artefacts, so this remains low confidence.

16. Who leaked the technical data on the bill validator to the gang?

Answer: _Hypothesis:_ Chase's "new buddy" who was tight on mortgage cash (name unresolved)

Evidence: decoded Telegram material says Chase sourced the ATM/validator PDF from a new friend or buddy who needed money for mortgage pressure. No proper name was recovered from the accessible artefacts outside the locked vault / Element path, so this remains low confidence.

17. Which offshore financial institution did the gang bank with? Provide its SWIFT code.

Answer: Crooked River Bank, CRVBPA2P

Evidence: iPhone Safari visited https://crbk.org/ with page title Crooked River Bank on 2024-03-20 10:31:10 UTC, and private/var/mobile/Media/DCIM/100APPLE/IMG_0032.PNG shows Google Authenticator configured for www.crbk.org: crbk.org. Final confirmation comes from the decoded Telegram secret chat with Chase: plaintext states Bank Name: Crooked River Bank ... SWIFT Code: CRVBPA2P ... Bank Address: 50 Offshore Blvd, Panama City, Panama. See ledger/ledger.md finding #50, IOC #51, IOC #45, and event #48 / #46.

18. Phorger's entire bank statement, containing all his offshore transactions.

Answer: _Hypothesis:_ the statement belongs to Crooked River Bank / Consulting Services Inc / account 9876543210, but the statement itself was not recovered.

Evidence: decoded secret-chat bank details identify the institution, account name, account number, and bank address, but not the full statement rows. The best current assessment is that the statement itself remains inside the locked vault container or another unrecovered banking artefact, so this remains low confidence / incomplete.