iPhone 16 Pro<\/p>\n\n\n\n
- \n
- 128 GB<\/li>\n\n\n\n
- Model Number: MYMC3LL\/A<\/li>\n\n\n\n
- Serial Number: HQM56HX5XV<\/li>\n\n\n\n
- iOS 26.1<\/li>\n<\/ul>\n\n\n\n
MacBook Air M2<\/p>\n\n\n\n
- \n
- 8GB<\/li>\n\n\n\n
- Serial Number: GK1JYKGVQM<\/li>\n\n\n\n
- macOS Sequoia Version 15.6.1<\/li>\n<\/ul>\n\n\n\n
Procedures<\/strong><\/p>\n\n\n\n
- \n
- U.S. official Richard Smith has been raising suspicion in and out of the office. They suspect him of contacting Russian officials. <\/li>\n\n\n\n
- Judge Evan Waters issued a search warrant that allows us to collect an iPhone and a MacBook from the suspect to gather evidence for our investigation.<\/li>\n<\/ul>\n\n\n\n
Softwares Used for iPhone:<\/strong><\/p>\n\n\n\n
- \n
- Cellebrite UFED: used for file-system extractions and analyzing messages, contacts, and call logs. It can also generate reports for the courts. <\/li>\n\n\n\n
- Magnet AXIOM: data acquisition<\/li>\n\n\n\n
- Autopsy: keyword search for \u201cRed Ralph.\u201d<\/li>\n<\/ul>\n\n\n\n
Steps:<\/p>\n\n\n\n
- \n
- Once the search warrant was granted, the phone and the laptop were taken to the digital forensics lab for examination. <\/li>\n\n\n\n
- The phone was connected to Cellebrite UFED. We created a new case to run the extraction. We navigated to contacts to locate \u201cRed Ralph\u201d and noted the phone number associated with it. We then navigated to messages to find the text confirming the lunch meeting on 2\/15\/2025. We also checked call logs for calls to and from \u201cRed Ralph.\u201d<\/li>\n\n\n\n
- Magnet AXIOM was used as a second tool to confirm the number and messages from \u201cRed Ralph.\u201d<\/li>\n\n\n\n
- Autopsy is used for hash lookup and keyword search for \u201cRed Ralph,\u201d phone number variants, and keywords such as \u201clunch\u201d and \u201cmeeting.\u201d<\/li>\n\n\n\n
- Documented evidence:\n
- \n
- Phone number: +7 (997-376-4414)<\/li>\n\n\n\n
- Contact name: Red Ralph<\/li>\n\n\n\n
- Message: Meet me at the restaurant at 1900 on 2\/15\/2025 to further discuss this topic.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Softwares used for MacBook:<\/strong><\/p>\n\n\n\n
- \n
- FTK Imager<\/li>\n<\/ul>\n\n\n\n
Using FTK Imager, we were able to search the MacBook\u2019s data files. We analyzed emails between Mr. Smith and Red Ralph. We also ensured that a forensic image was created to avoid altered data in the MacBook. We discovered emails between Mr. Smith and redralph@gmail.com. <\/p>\n\n\n\n
Email showed: <\/p>\n\n\n\n
![\"\"](\"https:\/\/student.wp.odu.edu\/cgala002\/wp-content\/uploads\/sites\/41160\/2026\/05\/image-576x1024.jpeg\")
<\/figure>\n\n\n\nConclusion:<\/strong><\/p>\n\n\n\n
After conducting a deep investigation of these two devices, we found evidence that Richard Smith and a Russian official were in contact about serious government secrets. Using the iPhone 16 Pro and the MacBook Air 2, we were able to find a Russian phone number linked to \u201cRed Ralph\u201d revealing conversations about secrets. There were also Emails concerning packages or letters sent between parties. The tools used for the investigation were Cellebrite UFED, Magnet AXIOM, Autopsy, and FTK Imager for the laptop. These tools helped confirm the interaction between Smith and \u201cRed Ralph.\u201d<\/p>\n\n\n\n
- FTK Imager<\/li>\n<\/ul>\n\n\n\n