A filing is not a verdict. Nothing on this site is a finding of liability.
The Record — theasbaghirecord.com. A filing is not a verdict. Nothing on this site is a finding of liability.
Section 04i
Phone anomalies
iOS printed that location sharing could not be stopped because of Screen Time restrictions or a managed device profile. Microsoft printed Created by your IT department. ProtonMail Contacts printed the same names many times, including Hoghooghi. Canary printed Untrusted connection. American Express printed Access Denied. padtan.com printed that the site does not support HTTPS. The App Store printed Get on WhatsApp Messenger while WhatsApp was already open and logged in. Screen Time was on. A recording of the phone shows the person holding it turning the master restrictions toggle off. Read every face on this page next to the AT&T statement: a sister, an iCloud, account material on a phone.
1 · On the record
What iOS and Microsoft printed
Two faces do the most work. One is Apple’s own dialog. One is Microsoft naming an IT department. Filenames on some of the stills say hacking. The prints are narrower than the filenames. That gap is the point of the labels.
Documented · iOS language
Screen Time, or a managed profile
Arlo Camera, step 2 of 3. “Unable to Stop Sharing Location. Location sharing could not be stopped due to Screen Time restrictions or a managed device profile installed on your iPhone.” That sentence is Apple’s. A Screen Time passcode can print the same dialog. A third-party enrollment can too. The print does not name who set it.
Documented · Microsoft language
Created by your IT department
Work or school account, created by an IT department, on an email that also had a personal Microsoft account. The email itself is not on the face. Yellow oval is on the original. The picker exists. It does not name the family as that IT department.
Context · the AT&T window
What the witness says a sister was receiving
Saqvan Ali wrote in 2020 that Hooman’s sister asked Del Mar AT&T to delete an iCloud; they refused. In 2026 he swore, under penalty of perjury, that she had passwords, messages, photographs, and iCloud-related information on her phone and did not want him to see. That writing is on The AT&T statement. Every still on this page is read next to that file. This page does not retry the store, and it does not write that she enrolled a managed profile.
Documented · Contacts
The same names, many times
ProtonMail Contacts, Online, clock 19:47. Hoghooghi / bhoghooghi@bcr-dc.com printed down the list. Aleksandr, Caro, Chase Investment 1. 1. 5, DJ, Drew Hall — the same pattern. That professional mailbox is the face. A sync loop can print repeating rows. The rows exist.
2 · Connections
Untrusted, denied, not secure
Canary printed that a connection was not trusted and might allow unauthorized access to the account. americanexpress.com printed Access Denied on EdgeSuite. Brave printed an HTTP-only warning on a truncated American Express host, attacker listed as a possibility after “does not support HTTPS.” An Amex re-authentication mail under his name sat under an offline toast; the one-time key is not readable on that face. padtan.com printed that the site does not support HTTPS — Brave’s own reason, not a forged certificate. DuckDuckGo printed an expired certificate for en.biotechfund.ir and listed attacker as one of three possibilities. m.facebook.com:0 asked to switch apps while a Golestaneh Iranian company page sat behind, the same unusual :0 as account.apple.com:0. Filenames on some of these stills say hacking or blockage. The prints are narrower. Ordinary 404s and region pages from the same harvest stay off this room. Read them next to the AT&T statement. This page does not write that a sister sat in the path.
3 · WhatsApp
Get, while the app is already open
Three recordings and two stills, clocks 17:42 to 18:01. The App Store listing for WhatsApp Messenger prints Get — the not-downloaded state. The same 17:43 recording then shows WhatsApp already open: Settings as HA, “Hey there! I am u…”, then Chats. A preview to Omid prints apps.apple.com/co/app — Apple’s Colombia storefront. After Get is used, the same listing prints Update. A companion still, 17:42, is Apple’s own dialog: “This item is currently being modified. Please try again later.” The three recordings are hosted. A near-duplicate of the dialog still is not mounted. The sentence “this app is not available in your country” is not on these five files; the /co/ path is the country print that is. A Colombia listing can refuse a download without a finding of targeting. Read it next to the AT&T statement and the apps.apple.com unverified still. This page does not write that a sister sat in the path.
3b · Bluetooth
Eight Connected, then seven. The (i) is missing on those rows.
He says this stretch began here: names he does not recognize, reconnecting, no information button, times next to a sensation at the hips. The Settings faces print part of that. Clock 01:12, MY DEVICES, eight Connected without an (i) — an LG webOS TV, three rows named only Accessory, Apple TV, iPad, two iPhone. AirPods Pro sit below as Not Connected, with an (i). Clock 01:10 is the same kind of list, scrolled, seven Connected. One version of each still. Eight is the high print. Filenames say hacking. The prints are Settings.
Bluetooth Off is not on these stills. A lawyer’s office is not on them. Pairing steps stay off the page. Scanner charts, finder distances, and a Razr tracker from the same harvest are not remounted. Read next to the AT&T statement. Meter videos are not this shelf — they sit on the medical door.
Documented
Sunday 27 April 2025. A VERBUS log headed [LG] webOS, MAC starting 67:10:7E, lists Heart Rate service 0x180D, Heart Rate Measurement 0x2A37, and Body Sensor Location 0x2A38. In the Bluetooth SIG table, Body Sensor Location value 0x01 is Chest. This log lists the characteristic. It does not print that byte. The same shelf prints untrusted joins: WHOOP 4C2820003 (E7:EE:2D:C8:74:8A), [LG] webOS TV UP7000PUA (24:E8:53:9C:8F:1D), and Unknown (7F:4B:66:A5:A3:08).
WHOOP is a commercial strap. CLI-W210W-01 is a thermostat model string. 0x180D is a real SIG service. An LG television is not a hip. His account is that the joins arrived with the vibration. Why a Smart Hip.
3c · CLI-W210W-01
What came back was the console’s own saved config
CLI-W210W-01 is a published Savant Multistat model number — a Wi-Fi HVAC thermostat. Product sheets for the W210 list Wi-Fi, not Bluetooth. He says he does not own that hardware. A neighbor’s Savant W210 would not ordinarily appear as a BLE serial endpoint on a stranger’s phone: the SKU is not a Bluetooth thermostat, and HVAC commissioning is not an open pairing. That is the first anomaly. The second is what the probe actually produced.
The dump dated 23 April 2025 is JSON from Serial Bluetooth Terminal — package de.kai_morich.serial_bluetooth_terminal. It saves pref_device_name CLI-W210W-01, BLE on, UTF-8, CR+LF, empty send macros. That is the app’s own preferences after a named radio was selected. It is not thermostat firmware. It is not implant code. A working HVAC controller does not emit an Android console’s config file. The whole page is the face, including the saved device address. This page does not reprint how to open the console.
He had lived with two hip replacements since 2015 and 2017. He says that around 2018 the surgeon described milder sensations as possibly loose hardware; those notes are not on this page. After Asbaghi vs Asbaghi was filed on 17 March 2025, he says the sensations at the hips became unignorable, and that they lined up with these connections. A person in that position looks at the hardware already in the body. He opened the health portal looking for the surgery file. That dump lands on Scripps. This page does not write that the radio sat inside the stem.
Conflict · keep the mismatch
The same harvest holds a USB-host library
mik3y / usb-serial-for-android. Copyright 2011–2013 Google Inc. and mike wakerly. Java interface UsbSerialDriver — getDevice, getPorts. That library talks to USB-serial chips on a cable. It is not Bluetooth Low Energy, and it is not a finding a Microchip radio was placed in the stem. Leaving it off this room would hide a leap that hurts the Settings faces. It stays, labeled conflict. nRF “Sample configuration” Heart Rate stills in the same folder are not mounted; they are a template, not live glucose or blood pressure. Wearables wait for that folder.
Not in this file
Whoop and health-band paper
If that folder is sent, it belongs on this page. Health data is PHI. A sample GATT Heart Rate screen is not that folder.
4 · Screen Time
Mixed Allow / Don’t Allow, 17:03 to 17:08
Content & Privacy Restrictions in a mixed state across a few minutes. Don’t Allow Changes checked on Speech Recognition and Bluetooth Sharing. Accounts Don’t Allow. A Photos recents still of the 17:03 screenshot. The faces are the exhibit. They are not a labeled before/after that names who set the lock.
5 · Screen Time · on camera
The master toggle
At 17:07, a recording of the same mixed Allow / Don’t Allow list, red pill in the status bar. At 17:10, Content & Privacy Restrictions toggled on, then off. He is holding the phone. He turned the master switch off. That is not a third party flipping it.
6 · Contacts
Hoghooghi, printed down the list
ProtonMail for iOS, Contacts, Online. The same surname as the 1 December 2022 outer forward on Apple ID. Two recordings of this list; they are not the same file. This is not a finding he cloned the address book, and it is not the later Bar-complaint file.
7 · Files, Safari, a cert, a scan
A lock, a :0, an ordinary sync port
Can’t Delete File is a real iOS dialog. The companion still circles Inbox; the oval is on the original. account.apple.com:0 asking to launch a commerce logout is on the face — unusual, not a finding the account was taken. Port 62078 labeled iphone-sync is Apple’s lockdownd / iTunes-sync service. This page does not reprint how to talk to it. A mail client’s unrecognized-certificate warning for a DonDominio cert is on the originals below.
Conflict · keep the mismatch
Filename says device hacking. Face is GitHub.
BypassForceP Device Hacking Evidence.jpeg. The still is GitHub GraphQL documentation: fields for BypassForceP, BranchActorAllowance, BranchProtectionRule. That is branch-protection schema, not an iPhone settings screen. Leaving it off this room would hide a mismatch that hurts the rest of the file. It stays, labeled conflict.