The Record

The Hooman Asbaghi Case

A filing is not a verdict. Nothing on this site is a finding of liability.

Section 04i

Phone anomalies

iOS printed that location sharing could not be stopped because of Screen Time restrictions or a managed device profile. Microsoft printed Created by your IT department. ProtonMail Contacts printed the same names many times, including Hoghooghi. Canary printed Untrusted connection. American Express printed Access Denied. padtan.com printed that the site does not support HTTPS. The App Store printed Get on WhatsApp Messenger while WhatsApp was already open and logged in. Screen Time was on. A recording of the phone shows the person holding it turning the master restrictions toggle off. Read every face on this page next to the AT&T statement: a sister, an iCloud, account material on a phone.

1 · On the record

What iOS and Microsoft printed

Two faces do the most work. One is Apple’s own dialog. One is Microsoft naming an IT department. Filenames on some of the stills say hacking. The prints are narrower than the filenames. That gap is the point of the labels.

Documented · iOS language

Screen Time, or a managed profile

Arlo Camera, step 2 of 3. “Unable to Stop Sharing Location. Location sharing could not be stopped due to Screen Time restrictions or a managed device profile installed on your iPhone.” That sentence is Apple’s. A Screen Time passcode can print the same dialog. A third-party enrollment can too. The print does not name who set it.

Documented · Microsoft language

Created by your IT department

Work or school account, created by an IT department, on an email that also had a personal Microsoft account. The email itself is not on the face. Yellow oval is on the original. The picker exists. It does not name the family as that IT department.

Context · the AT&T window

What the witness says a sister was receiving

Saqvan Ali wrote in 2020 that Hooman’s sister asked Del Mar AT&T to delete an iCloud; they refused. In 2026 he swore, under penalty of perjury, that she had passwords, messages, photographs, and iCloud-related information on her phone and did not want him to see. That writing is on The AT&T statement. Every still on this page is read next to that file. This page does not retry the store, and it does not write that she enrolled a managed profile.

Documented · Contacts

The same names, many times

ProtonMail Contacts, Online, clock 19:47. Hoghooghi / bhoghooghi@bcr-dc.com printed down the list. Aleksandr, Caro, Chase Investment 1. 1. 5, DJ, Drew Hall — the same pattern. That professional mailbox is the face. A sync loop can print repeating rows. The rows exist.

2 · Connections

Untrusted, denied, not secure

Canary printed that a connection was not trusted and might allow unauthorized access to the account. americanexpress.com printed Access Denied on EdgeSuite. Brave printed an HTTP-only warning on a truncated American Express host, attacker listed as a possibility after “does not support HTTPS.” An Amex re-authentication mail under his name sat under an offline toast; the one-time key is not readable on that face. padtan.com printed that the site does not support HTTPS — Brave’s own reason, not a forged certificate. DuckDuckGo printed an expired certificate for en.biotechfund.ir and listed attacker as one of three possibilities. m.facebook.com:0 asked to switch apps while a Golestaneh Iranian company page sat behind, the same unusual :0 as account.apple.com:0. Filenames on some of these stills say hacking or blockage. The prints are narrower. Ordinary 404s and region pages from the same harvest stay off this room. Read them next to the AT&T statement. This page does not write that a sister sat in the path.

3 · WhatsApp

Get, while the app is already open

Three recordings and two stills, clocks 17:42 to 18:01. The App Store listing for WhatsApp Messenger prints Get — the not-downloaded state. The same 17:43 recording then shows WhatsApp already open: Settings as HA, “Hey there! I am u…”, then Chats. A preview to Omid prints apps.apple.com/co/app — Apple’s Colombia storefront. After Get is used, the same listing prints Update. A companion still, 17:42, is Apple’s own dialog: “This item is currently being modified. Please try again later.” The three recordings are hosted. A near-duplicate of the dialog still is not mounted. The sentence “this app is not available in your country” is not on these five files; the /co/ path is the country print that is. A Colombia listing can refuse a download without a finding of targeting. Read it next to the AT&T statement and the apps.apple.com unverified still. This page does not write that a sister sat in the path.

3b · Bluetooth

Eight Connected, then seven. The (i) is missing on those rows.

He says this stretch began here: names he does not recognize, reconnecting, no information button, times next to a sensation at the hips. The Settings faces print part of that. Clock 01:12, MY DEVICES, eight Connected without an (i) — an LG webOS TV, three rows named only Accessory, Apple TV, iPad, two iPhone. AirPods Pro sit below as Not Connected, with an (i). Clock 01:10 is the same kind of list, scrolled, seven Connected. One version of each still. Eight is the high print. Filenames say hacking. The prints are Settings.

Bluetooth Off is not on these stills. A lawyer’s office is not on them. Pairing steps stay off the page. Scanner charts, finder distances, and a Razr tracker from the same harvest are not remounted. Read next to the AT&T statement. Meter videos are not this shelf — they sit on the medical door.

Documented

Sunday 27 April 2025. A VERBUS log headed [LG] webOS, MAC starting 67:10:7E, lists Heart Rate service 0x180D, Heart Rate Measurement 0x2A37, and Body Sensor Location 0x2A38. In the Bluetooth SIG table, Body Sensor Location value 0x01 is Chest. This log lists the characteristic. It does not print that byte. The same shelf prints untrusted joins: WHOOP 4C2820003 (E7:EE:2D:C8:74:8A), [LG] webOS TV UP7000PUA (24:E8:53:9C:8F:1D), and Unknown (7F:4B:66:A5:A3:08).

WHOOP is a commercial strap. CLI-W210W-01 is a thermostat model string. 0x180D is a real SIG service. An LG television is not a hip. His account is that the joins arrived with the vibration. Why a Smart Hip.

3c · CLI-W210W-01

What came back was the console’s own saved config

CLI-W210W-01 is a published Savant Multistat model number — a Wi-Fi HVAC thermostat. Product sheets for the W210 list Wi-Fi, not Bluetooth. He says he does not own that hardware. A neighbor’s Savant W210 would not ordinarily appear as a BLE serial endpoint on a stranger’s phone: the SKU is not a Bluetooth thermostat, and HVAC commissioning is not an open pairing. That is the first anomaly. The second is what the probe actually produced.

The dump dated 23 April 2025 is JSON from Serial Bluetooth Terminal — package de.kai_morich.serial_bluetooth_terminal. It saves pref_device_name CLI-W210W-01, BLE on, UTF-8, CR+LF, empty send macros. That is the app’s own preferences after a named radio was selected. It is not thermostat firmware. It is not implant code. A working HVAC controller does not emit an Android console’s config file. The whole page is the face, including the saved device address. This page does not reprint how to open the console.

He had lived with two hip replacements since 2015 and 2017. He says that around 2018 the surgeon described milder sensations as possibly loose hardware; those notes are not on this page. After Asbaghi vs Asbaghi was filed on 17 March 2025, he says the sensations at the hips became unignorable, and that they lined up with these connections. A person in that position looks at the hardware already in the body. He opened the health portal looking for the surgery file. That dump lands on Scripps. This page does not write that the radio sat inside the stem.

Conflict · keep the mismatch

The same harvest holds a USB-host library

mik3y / usb-serial-for-android. Copyright 2011–2013 Google Inc. and mike wakerly. Java interface UsbSerialDriver — getDevice, getPorts. That library talks to USB-serial chips on a cable. It is not Bluetooth Low Energy, and it is not a finding a Microchip radio was placed in the stem. Leaving it off this room would hide a leap that hurts the Settings faces. It stays, labeled conflict. nRF “Sample configuration” Heart Rate stills in the same folder are not mounted; they are a template, not live glucose or blood pressure. Wearables wait for that folder.

Not in this file

Whoop and health-band paper

If that folder is sent, it belongs on this page. Health data is PHI. A sample GATT Heart Rate screen is not that folder.

4 · Screen Time

Mixed Allow / Don’t Allow, 17:03 to 17:08

Content & Privacy Restrictions in a mixed state across a few minutes. Don’t Allow Changes checked on Speech Recognition and Bluetooth Sharing. Accounts Don’t Allow. A Photos recents still of the 17:03 screenshot. The faces are the exhibit. They are not a labeled before/after that names who set the lock.

5 · Screen Time · on camera

The master toggle

At 17:07, a recording of the same mixed Allow / Don’t Allow list, red pill in the status bar. At 17:10, Content & Privacy Restrictions toggled on, then off. He is holding the phone. He turned the master switch off. That is not a third party flipping it.

6 · Contacts

Hoghooghi, printed down the list

ProtonMail for iOS, Contacts, Online. The same surname as the 1 December 2022 outer forward on Apple ID. Two recordings of this list; they are not the same file. This is not a finding he cloned the address book, and it is not the later Bar-complaint file.

7 · Files, Safari, a cert, a scan

A lock, a :0, an ordinary sync port

Can’t Delete File is a real iOS dialog. The companion still circles Inbox; the oval is on the original. account.apple.com:0 asking to launch a commerce logout is on the face — unusual, not a finding the account was taken. Port 62078 labeled iphone-sync is Apple’s lockdownd / iTunes-sync service. This page does not reprint how to talk to it. A mail client’s unrecognized-certificate warning for a DonDominio cert is on the originals below.

Conflict · keep the mismatch

Filename says device hacking. Face is GitHub.

BypassForceP Device Hacking Evidence.jpeg. The still is GitHub GraphQL documentation: fields for BypassForceP, BranchActorAllowance, BranchProtectionRule. That is branch-protection schema, not an iPhone settings screen. Leaving it off this room would hide a mismatch that hurts the rest of the file. It stays, labeled conflict.

8 · The originals

Click a face. The context travels with it.

DocumentedClock 17:29 · calendar date not on the face
Arlo — Unable to Stop Sharing Location, Screen Time or a managed profile

iOS dialog over an Arlo Camera row. Calendar date is not printed. Clock 17:29.

Step 2 of 3. Arlo Camera. Dialog: “Unable to Stop Sharing Location. Location sharing could not be stopped due to Screen Time restrictions or a managed device profile installed on your iPhone.” OK. Select All & Stop Access is behind the dialog.

Establishes. iOS printed that location sharing could not be stopped because of Screen Time restrictions or a managed device profile. That sentence is on the face. It is Apple’s language, not a caption added later.

Does not establish. Does not prove a third party enrolled the phone. A Screen Time passcode the owner set can print the same dialog. Does not identify who set Screen Time. Does not prove the sister, mother, or an employer installed a profile. The AT&T witness file is context in a different window, not a finding this dialog was their doing.

Source: hacking unable to stop sharing locaiton.jpeg

DocumentedClock 11:23 · Photos chrome Today 23:33 · calendar date not on the face
Microsoft — Work or school account, Created by your IT department

Photos still of a Microsoft picker. Yellow oval is on the original. The email address is not printed.

Microsoft: “We need a little more help. It looks like this email is used with more than one account from Microsoft. Which one do you want to use?” Work or school account — “Created by your IT department.” Personal account — “Created by you.” Highlight on the work/school row is on the original JPEG.

Establishes. Microsoft showed a work-or-school account created by an IT department for an email that also had a personal Microsoft account. The picker exists. The email itself is not on this face.

Does not establish. Does not print which email. Does not prove a family member was that IT department. Does not prove MDM enrolled the iPhone. A work mailbox and a personal mailbox on one address is a known Microsoft prompt. Stack it with the AT&T file as context, not as a finding.

Facts

No public URL mounted yet. The face is quoted above.

Source: Created by your IT department.jpeg

DocumentedClocks 17:07 and 17:10 · calendar date not on the face
Screen Time recordings — restrictions on, then the master toggle off

Four frames from two recordings. Red recording pill is on the original. He is holding the phone.

17:07, red pill: Content & Privacy Restrictions mixed — Share My Location Don’t Allow, Bluetooth Sharing Don’t Allow, Microphone Allow, Speech Recognition Don’t Allow. 17:10: same mixed privacy list, then the master Content & Privacy Restrictions toggle ON, then the same toggle OFF. Location Services / Contacts / Calendars remain Allow on those frames.

Establishes. Two recordings exist of Content & Privacy Restrictions in the same clock window as the nine stills. One recording shows the mixed Allow / Don’t Allow list. The other shows the master switch on, then off, while a red recording pill is in the status bar. He demonstrated turning the master toggle off.

Does not establish. Does not prove a third party flipped the switch. The off frame is him turning the control off on a recording he made. A snapshot and a recording of that toggle going off are not a timed revert from outside the phone.

Facts

No public URL mounted yet. The face is quoted above.

Source: Content&PrivacyRestrictionsAnomaly.mp4 and ContentPrivacyAnomaly.mp4. Frames from two recordings.

DocumentedClocks 17:03–17:08 · calendar date not on the face
Screen Time — Content & Privacy Restrictions, mixed Allow / Don’t Allow

Nine Screen Time stills from one clock window. Harvest filenames claim the toggles would not hold. The faces are snapshots, not a labeled before/after.

Content & Privacy Restrictions. One still: Location, Contacts, Calendars, Reminders, Photos, Microphone, Speech Recognition, Bluetooth Sharing = Allow; Share My Location = Don’t Allow. Another: Share My Location and Bluetooth Sharing = Don’t Allow; Microphone = Allow; Accounts = Don’t Allow. Speech Recognition set to Don’t Allow Changes with app toggles off. Bluetooth Sharing set to Don’t Allow Changes with BLE Finder, Bose Connect, Home Security Camera among the listed apps. A Photos recents still is a screenshot of the 17:03 restrictions page, viewed at 17:08.

Establishes. Screen Time Content & Privacy Restrictions were on, in a mixed Allow / Don’t Allow state, at 17:03–17:08 on these stills. Don’t Allow Changes was checked on Speech Recognition and Bluetooth Sharing. Those prints exist.

Does not establish. Filenames on some of the stills say the settings go right back to allowing. A revert is his account. These faces are not a timed before/after that proves a third party overrode the lock. Screen Time can be set by the owner. BLE Finder on a Bluetooth-sharing list is an app that requested Bluetooth — not a finding it was used to clone a device.

Facts

No public URL mounted yet. The face is quoted above.

Source: Privacy settings don_t hold.jpeg; Hacking Privacy Sharing.jpeg; Goes right back to allowing.jpeg; Unable to stop sharing privacy settings.jpeg; Attempting to stop allowing sharing (unable).jpeg; Bluetooth sharing unable.jpeg; Hacking unable to make changes.jpeg; Hacking Unable to provide info.jpeg; Hacking unable to turn off sharing.jpeg

DocumentedClock 4:28 · calendar date not on the face
Canary — Untrusted connection, may allow unauthorized access

Canary mail-app dialog. Two near-duplicate stills exist; this is the clearer face.

“Untrusted connection. This connection is not trusted by Canary and may allow unauthorized access to your account. If this connection is secure, go to Canary under iPhone settings to allow untrusted connections or try again on a different connection.” Go to settings / Cancel connection.

Establishes. Canary printed that a connection was not trusted and might allow unauthorized access to the account. That sentence is on the face.

Does not establish. An untrusted-mail-server warning is not a finding of a man-in-the-middle. A bad cert, a captive portal, or a VPN can print the same sheet. Does not name who presented the connection. Does not teach Allow untrusted connections.

Source: Untrusted connection..jpeg

DocumentedClocks 22:42 and undated browser chrome · calendar date not on the faces
American Express — Access Denied, HTTP-only warning, re-auth mail offline

Three faces. Filename on the HTTP still says hacking. The face is Brave’s HTTPS-Only sheet. Yellow marks on the re-auth mail are on the original. The one-time key is covered by the offline toast.

americanexpress.com, Access Denied, EdgeSuite reference, permission denied for http://americanexpress.com/. Companion: Brave “Secure site not available,” broken lock, “Most likely, the website simply does not support HTTPS. However, it’s also possible that an attacker is involved.” Third: Amex re-authentication mail, Dear HOOMAN ASBAGHI, overlay “Could not reach server, looks like you are offline.”

Establishes. The browser printed Access Denied on americanexpress.com. Brave printed an HTTP-only warning with an attacker-possible sentence for a truncated americanexpress host. An Amex re-auth mail under his name sat under an offline toast. Those prints exist.

Does not establish. EdgeSuite Access Denied is a common bot/WAF page and is not unique to Amex on this harvest. Brave’s attacker sentence is one of two possibilities on its own template, the first being “does not support HTTPS.” An offline toast over a one-time key is not a finding the bank was intercepted. Does not print the key.

Facts

No public URL mounted yet. The face is quoted above.

Source: AmericanExpressAccessDenied.jpeg; American Express Hacking Device evidence.jpeg; HA American Express Authentication.jpeg

DocumentedClock 08:08 · calendar date not on the face
Brave — padtan.com, connection is not secure, site does not support HTTPS

Brave. Address bar padtan.com. Lion shield on the original.

“The connection to padtan.com is not secure. You are seeing this warning because this site does not support HTTPS.” Proceed / Go Back.

Establishes. Brave printed that padtan.com does not support HTTPS. He was on that host. That warning exists.

Does not establish. “Does not support HTTPS” is Brave saying the site is HTTP, not that someone forged a certificate. A company site without TLS prints this every time. It is not a finding of intercept. Does not teach Proceed.

Source: Padtan not secure connection.jpeg

DocumentedClock 00:43 · calendar date not on the face
DuckDuckGo — en.biotechfund.ir, certificate expired

DuckDuckGo. Filename says attacker compromised. The face says the certificate is expired and lists three possibilities.

en.biotechfund.ir. “Warning: This site may be insecure. The certificate for this site is invalid.” DuckDuckGo: “The security certificate for en.biotechfund.ir is expired. It’s possible that the website is misconfigured, that an attacker has compromised your connection, or that your system clock is incorrect.” Accept Risk and Visit Site / Leave This Site.

Establishes. DuckDuckGo printed an invalid, expired certificate for en.biotechfund.ir and listed attacker as one of three possibilities. That page exists.

Does not establish. An expired certificate is the print. Misconfiguration is on the same template. This is not a finding an attacker sat on the path. Filename overclaims the face. Does not teach Accept Risk.

Facts

No public URL mounted yet. The face is quoted above.

Source: WarningAttackerCompromisedConnection.jpeg

DocumentedClock 21:25 · calendar date not on the face
Brave — m.facebook.com:0 asked to switch apps, Golestaneh behind

Brave dialog over m.facebook.com. Filename says blockage. The face is a :0 switch-apps sheet. Golestaneh Iranian company is on the page behind.

“Allow https://m.facebook.com:0 to switch apps?” fb:/profile/?id=100064171172797… will launch an external application. Don’t Allow / Allow. Behind: Facebook login chrome and “Golestaneh Iranian company updated their profile picture.”

Establishes. Brave asked whether m.facebook.com:0 could switch apps while a Golestaneh Iranian company Facebook page sat behind the dialog. The :0 is on the face, as it is on the account.apple.com:0 still in this room.

Does not establish. A Facebook deep-link handoff can print an external-application prompt. Port :0 is unusual and is the anomaly — it is not a finding Facebook was blocked. Does not prove who ran the page. Does not teach Allow.

Source: Facebook Blockage.jpeg

DocumentedClocks 01:10–01:12 · calendar not on the Settings faces
iOS Bluetooth Settings — eight Connected, then seven, no (i) on those rows

Filenames say hacking. The prints are Settings MY DEVICES. Calendar date is not on these faces. One version of each still.

Clock 01:12: Connected, without an (i): [LG] webOS TV UP…, Accessory, Accessory, Accessory, Apple TV, iPad, iPhone, iPhone. AirPods Pro Not Connected, with an (i). Discoverable as iPhone Big while Bluetooth Settings is open. Clock 01:10: seven Connected — Accessory ×3, Apple TV, iPad, two iPhone — header scrolled off. Not Connected with an (i): AirPods Pro twice, Beats Fit Pro, Beats Studio.

Establishes. iOS printed a MY DEVICES list with eight rows marked Connected, then seven on a still two minutes earlier. Those Connected rows have no information button. The names include generic Accessory, two iPhone, an iPad, Apple TV, and an LG webOS TV.

Does not establish. Does not print Bluetooth Off. Does not print a lawyer’s office. Does not print CLI-W210W-01 — that name sits on the serial-console dump, not on these two Settings faces. Does not prove the radios were implants. Eight Connected is the high print in this dump, not nine. A missing (i) is the print, not a finding Apple hid a pairing.

Source: BLuetooth 8 devices no info.jpeg; Bluetooth 7 devices no info.jpeg. A six-Connected still, finder distances, Razr tracker, and N/A scanner charts from the same harvest are not remounted.

Documented23 Apr 2025
Serial Bluetooth Terminal — saved config, not thermostat firmware

Android preference JSON. The whole page is the face, including pref_device_address. This page does not teach how to open the console.

package de.kai_morich.serial_bluetooth_terminal. date 20250423-122343. pref_device_name CLI-W210W-01. pref_device_address 9C:1D:58:FD:32:BF. pref_device_le true. charset UTF-8. receive newline CR+LF. pref_m4_value empty.

Establishes. An Android serial-console app had CLI-W210W-01 saved as its BLE device on 23 April 2025. The dump is the app’s own saved preferences. It is not firmware a thermostat emitted, and it is not implant code. CLI-W210W-01 is a published Savant Multistat Wi-Fi HVAC SKU; a W210 is not sold as a Bluetooth thermostat.

Does not establish. Does not prove the endpoint sat inside a hip stem. Does not prove a neighbor’s HVAC was taken over. Empty send macros are not a command sequence. Does not merge this dump with usb-serial-for-android source in the same folder.

Source: IMG_0251.PNG. A generative-summary still of the same dump is not remounted.

Conflict — keep bothFilename 23 Apr 2025
usb-serial-for-android Java — USB-host library, not a BLE implant

Document viewer on a screenshot named Screenshot_20250423-142034. Harvest filename says GithubMik3y.

Copyright 2011–2013 Google Inc.; 2013 mike wakerly. Project home page github.com/mik3y/usb-serial-for-android. package com.hoho.android.usbserial.driver. public interface UsbSerialDriver with getSupportedDevices, probe, getDevice, getPorts.

Establishes. The Bluetooth harvest includes source of an Android USB-host serial library. That source exists in the folder next to the Settings stills.

Does not establish. A USB-serial driver for FTDI, CDC, and similar chips is not Bluetooth Low Energy and is not a finding a Microchip radio was placed in a Stryker stem. Does not prove later maintainers’ commits were aimed at this case. Does not reprint how to talk to those chips.

Source: Hacking GithubMik3y.jpeg. Other pages of the same library’s unit tests in this harvest not remounted.

DocumentedClock 11:27 · file dates on the list run 21 Oct–16 Nov 2022
Files — Can’t Delete File

Two Files stills. Overlay on the first. Same folder list on the second.

Files list including genomerev1 (11/16/22), HBA PAYMENT (11/11/22), HBA REVISED (10/21/22), my livfe rev 18, my. story French, NETWORK copy copy. Dialog: “Can't Delete File. This file can’t be deleted now. Please try again later.” Companion still is the same list without the dialog.

Establishes. The Files app printed that a file in that folder could not be deleted at that moment. The file names on the list are on the face.

Does not establish. A temporary Files lock is not a finding of malware. iOS prints this dialog for open documents, iCloud conflicts, and permissions. Does not prove a third party froze the folder. Does not teach a bypass.

Facts

No public URL mounted yet. The face is quoted above.

Source: Can_t Delete File.jpeg and Can´t Delete FIle 2.jpeg

DocumentedClock 23:32 · calendar date not on the face
Safari — account.apple.com:0 asked to switch apps

Safari on account.apple.com. Brave shield visible. No Apple ID printed.

Address bar: account.apple.com. Dialog: “Allow https://account.apple.com:0 to switch apps? https://apps.apple.com/includes/commerce/logout will launch an external application.” Don’t Allow / Allow. Page behind: “One account for everything Apple.”

Establishes. Safari asked whether account.apple.com:0 could switch apps and launch apps.apple.com/includes/commerce/logout as an external application. The :0 is on the face.

Does not establish. Does not prove a hijack. A logout handoff can print an external-application prompt. Port :0 is unusual and is the anomaly on this still — it is not a finding someone else was in the account. No Apple ID is printed. This page does not reprint a method.

Facts

No public URL mounted yet. The face is quoted above.

Source: hacking apple external.jpeg

DocumentedDate not on the face
Mail — Unrecognized Certificate, DonDominio / Soluciones Corporativas IP

Android-style certificate dialog. Company registrar email is on the cert, not a personal mailbox.

“Unrecognized Certificate. The server presented an invalid SSL certificate… Sometimes it is because someone is trying to attack you or your mail server.” Trust-anchor exception. Subject EMAILADDRESS=info@scip.es, CN=Mail Service, OU=DonDominio, O=Soluciones Corporativas IP SL, L=Manacor, ST=Illes Balears, C=ES. REJECT KEY / ACCEPT KEY.

Establishes. A mail client printed an invalid-certificate warning for a DonDominio / Soluciones Corporativas IP SL mail-service cert. That warning exists.

Does not establish. An untrusted cert is not a finding of a man-in-the-middle. Misconfiguration and self-signed mail hosts print the same dialog. Does not identify who presented the cert. Does not prove the family intercepted mail. This page does not teach Accept Key.

Facts

No public URL mounted yet. The face is quoted above.

Source: Hacking Unrecognized Certificate.jpeg

DocumentedInner UI 31 Jan 2024, 06:21 · outer clock 4:28
Network scan still — open port 62078, iphone-sync

Photograph of a phone. Inner scanner UI dated 1/31/24. Tape over the camera area is on the original.

Target host Generic. Open ports: 1. Port 62078 labeled iphone-sync. Helper text: “Apparently used by iPhone while syncing” plus a code.google.com/p/iphone-elite wiki line. Inner clock 1/31/24, 06:21. Outer still 4:28.

Establishes. A saved scan printed port 62078 with the stock label iphone-sync. Apple’s lockdownd / iTunes-sync service listens on that port. The still exists.

Does not establish. An open 62078 on an iPhone is the ordinary sync port, not a finding of unauthorized access. This page does not reprint how to connect to it. Tape on the camera is on the original photograph; it is not a finding of physical tampering. Not a use finding against sayem314/hooman.

Facts

No public URL mounted yet. The face is quoted above.

Source: iphone-syncanomaly.jpeg

Conflict — keep bothDate not on the face
Harvest labeled Device Hacking Evidence — face is GitHub BypassForceP fields

Public GitHub GraphQL docs still. Filename says device hacking. The face is not an iPhone settings screen.

Docs page: “Implements” / Node. “Fields for BypassForceP.” Name: actor (BranchActorAllowance); branchProtectionRule (BranchProtectionRule). Yellow oval on the original.

Establishes. The file was saved under a device-hacking filename. The face prints GitHub GraphQL fields for bypassing branch protection (BypassForceP / BranchActorAllowance). That mismatch is on the record.

Does not establish. This is not an iPhone screen. It does not prove a security bypass on his phone. Treating GitHub schema docs as device-hacking evidence would weaken the room. It stays so the mismatch is visible.

Facts

No public URL mounted yet. The face is quoted above.

Source: BypassForceP Device Hacking Evidence.jpeg