tom brady - phone documents

8/20/2019 Tom Brady - Phone Documents

1/17

SUPPLEMENTAL DECLARATION OF BRAD MARYMAN

The following is Supplemental to my Declaration in this matter dated June 14, 2015.

I, Brad Maryman, declare and state as follows:

1. In May 2015, my company, Maryman & Associates, Inc. was retained to perform a forensic examination

and analysis of two mobile phone devices used by Mr. Thomas Brady, Jr. One a Samsung Galaxy Note 3 (AT&T

service) and the other a Samsung Galaxy Note 4 (Verizon service).

2. On June 3, 2015, under my supervision and direction, one of my associate Forensic Examiners conducted

forensic imaging of the two mobile phone devices. The two devices were assigned M&A evidence ID’s 01BVN01 -

Samsung Galaxy Note 3 and 01BVN02 – Samsung Galaxy Note 4.

3. Both of the mobile phone devices were forensically imaged with Cellebrite’s UFED 4PC Ultimate Version

4.2.1. Based upon its make, model and Operating System (OS) the Samsung Galaxy Note 4 was imaged via a

Logical File System acquisition. Based upon its make, model and Operating System (OS) the Samsung Galaxy Note

3 was imaged via a full Physical acquisition.

4. An initial examination of the Samsung Galaxy Note 4 indicated that its dates of active use were from

March 6, 2015 through April 8, 2015. As such it was deemed to be outside the scope of the investigation and no

further analysis was conducted

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):< 3=>$? ,;@,A@&( B"C$ & 5D :


2/17

further analysis was conducted

7. A total of 106 MMS messages were found for the period October 5, 2015 to November 4, 2014.

Multimedia Messaging Service (MMS) is a standard protocol to send messages that include multimedia content to

and from mobile devices.

8. The following personal names and telephone numbers were provided for search purposes:

John Jastremski - 508-958-****

Dave Schoenfeld - 978-973-****

Jim McNally - 603-321 (we weren't provided the last 4 digits of Mr. McNally’s telephone number).

9. The following search terms were used to locate and identify relevant items to the provided personal names

and telephone numbers: jastremski; schoenfeld; mcnally and all known format permutations of telephone numbers

508-958-****, 978-973-**** and 603-321.

10. Number of search hit results for any of the above noted search terms in SMS messages - None.

11. Number of search hit results for any of the above noted search terms in MMS messages - None.

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):< 3=>$? ,;@,A@&( B"C$ : 5D :


3/17

DECLARATION OF BRAD MARYMAN

I, Brad Maryman, declare and state as follows:

1. I am the owner and President of Maryman & Associates Inc., a professional services firm specializing in

computer forensics, cyber investigations, incident response and security consulting. I have over 43 years of

experience in conducting investigations, collecting evidence and analyzing evidentiary items. The firm’s associates

have wide-ranging investigative, security and forensic experiences with backgrounds in military, law enforcement,

intelligence and academia. They are located in cities across the country and have traveled internationally in support

of highly sophisticated and complex forensic and cyber matters for our clients and their legal representation.

2. Prior to founding Maryman & Associates Inc., I served as a Supervisory Special Agent with the Federal

Bureau of Investigation (FBI) for over 29 years. During that time, I conducted and supervised investigations, served

as an Information Systems Administrator, Chief Information Security Officer (CISO) and Security Programs

Manager. I was a founding member of the FBI’s Computer Analysis Response Team (CART Team) where I

received extensive training from the FBI and scientific industry experts in the acquisition, examination and analysis

of computer evidence, also known as computer forensics. I received certification by the FBI Laboratory as a

“Forensic Examiner of Computer Evidence.” I have performed thousands of hours of computer forensic

investigation to include forensic data acquisition and analysis of an extensive variety of digital evidence items

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):& 3 ,;?,@?&( A"B$ & 5C -


4/17

California (USC) Information Technology Program Advisory Board and am a frequent guest lecturer at USC on

digital forensics. I am also a member of the Information Systems Security Association and serve on the Los Angeles

Chapter Community Outreach Advisory Board.

4. I am licensed as a Private Investigator by the California Bureau of Security and Investigative Services and

hold license number 26012.

5. Please see my Curriculum Vitae (CV) attached as Exhibit A for additional information regarding my

experience and qualifications.

6. In May 2015, my company, Maryman & Associates, Inc. was retained to perform a forensic examination

and analysis of the e-Mail account of Mr. Thomas Brady, Jr.: ***********@**********.com

7. On June 3, 2015, under my supervision and direction, one of my associate Forensic Examiners accessed the

above noted e-Mail account. Its data was subsequently acquired via an IMAP connection to a server hosted by

Apple, Inc. utilizing Aid4Mail eDiscovery v 3.61. All e-mail messages and their attachments with a store date (sent

or received date) between September 1, 2014 and March 1, 2015 were preserved to a PST file and stored on a best

evidence drive. The PST contains 5,317 messages. In computing, a Personal Storage Table (.PST) is an open

proprietary file format used to store copies of messages, calendar events, and other items.

8 The PST file from the best evidence drive was copied to a working copy drive The two files were

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):& 3 ,;?,@?&( A"B$ : 5C -


5/17

10. Results:

a. Requested Search Term: k-ball

Term as Searched: “k - ball”

Result: No Results

b. Requested Search Term: kball

Term as Searched: kball

Result: No Results

c. Requested Search Term: gage

Term as Searched: gage

Result: No Results

d. Requested Search Term: air-pump

Term as Searched: “air - pump”

Result: No Results

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):& 3 ,;?,@?&( A"B$ C 5D -


6/17

messages and 44 attachments were all communications between Tom Brady and Josh McDaniels

(**********@*******.com). These files all appear to be related to the Patriots organization and their game day call

sheets/play sheets.

g. Requested Search Term: pin

Term as Searched: pin

Result: 28 files containing one or more instances of the given search term were discovered. These were

contained in 11 e-mail messages, 12 Excel files, two plain text documents, one vCard file, and two XHTML documents.

The 11 e-mail messages include play calling, family discussions, discussions with friends, e-mail messages relating

to PIN as a Personal Identification Number, and PIN as a Property Identification Number. The 12 Excel files are all

Patriots call sheets/play sheets. The two plain text documents and the two XHTML documents are both attachments

of e-mail messages described above. The vCard contains PIN as a personal identification number.

h. Requested Search Term: PSI

Term as Searched: PSI

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):& 3 ,;?,@?&( A"B$ @ 5C -


7/17


contained in seven e-mail messages, three PDF files, one plain text document, and one XHTML document. The files

include discussions of Tom Brady’s shoe size, a description of working hours in a day, and distance in miles.

k. Requested Search Term: bladder

Term as Searched: bladder

Result: Two files containing one or more instances of the given search term were discovered. These were

contained in one plain text document and one XHTML document. Both files refer to the bladder as a component of

the human body.

l. Requested Search Term: McNally

Term as Searched: McNally

Result: No Results

m. Requested Search Term: Bird

Term as Searched: Bird

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):& 3 ,;?,@?&( A"B$ ( 5C -


8/17

o. Requested Search Term: 1 lb

Term as Searched: “1 lb”

Result: No Results

p. Requested Search Term: one pound

Term as Searched: “one pound”

Result: No Results

q. Requested Search Term: one lb

Term as Searched: “one lb”

Result: No Results

r. Requested Search Term: 2 pound

Term as Searched: “2 pound”

Result: No Results

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):& 3 ,;?,@?&( A"B$ . 5C -


9/17

u. Requested Search Term: two lb

Term as Searched: “two lb”

Result: No Results

v. Requested Search Term: gaug*

Term as Searched: gaug*

Result: Seven files containing one or more instances of the given search term were discovered. These were

contained in three e-mail messages, two Excel files, one plain text, and one XHTML document. These files include

references to allowing someone to gauge reactions or interest and Patriots call sheets/play sheets.

w. Requested Search Term: pump*

Term as Searched: pump*


contained in 30 e-mail messages, 41 Excel files, one PDF file, 11 plain text, and 11 XHTML documents. These files

include references to pumping water, installing a pump to pump water, pumpkins, Patriots play calls, “muscle pump

function ” pumped as a way to express excitement a heat pump for a house and prices at the gasoline pump

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):& 3 ,;?,@?&( A"B$ C 5D -


10/17

y. Requested Search Term: deflat*

Term as Searched: deflat*


contained in 17 e-mail messages, one HTML document, and three PDF files. These files include references to media

reports, economic deflation, e-mails between Tom Brady’s financial advisor, personal e-mails, and media reports.

z. Requested Search Term: (game or kick*) /2 ball

Term as Searched: "(game OR kick*) ball" ~2 [Search for game or kick* within two words of ball]


contained in six e-mail messages, three Excel files, one plain text document, and one XHTML document. These files

include personal e-mails and Patriots call sheets/play sheets.

aa. Requested Search Term: (prep* or rub*) /10 (ball or football)

Term as Searched: "(prep* OR rub*) AND (ball OR football)" ~10 [Search for prep* or rub* within 10 words

of ball or football]

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):& 3 ,;?,@?&( A"B$ ; 5C -


11/17

Result: 29 files containing one or more instances of the first search term were discovered. These were

contained in 21 e-mail messages, five PDF files, one HTML, one XHTML, and one plain text documents. These files

include personal e-mails and media reports.

cc. Requested Search Term: investigat* /10 (ball or football or Indianapolis or Indy or Colts)

Term as Searched: "investigat* AND (ball OR football OR Ind* OR Colts)" ~10 [Search for investigat*

within 10 words of ball, football, Ind*, or Colts]

Result: Two files containing one or more instances of the given search term were discovered. These were

contained in two e-mail messages.

dd. Requested Search Term: (equilibrium or equilibrat* or atmosphere* or climat* or environment* or test* or

experiment) /10 (ball or football)

Term as Searched: "(equilib* OR atmosphere* OR climat* OR environment* OR test* OR experiment) AND

(ball OR football)" ~10 [Search for equilib*, atmosphere*, climat*, environment*, test*, or experiment within 10

words of ball or football]


!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):& 3 ,;?,@?&( A"B$ - 5C -


12/17

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):$? ,;@,A@&( B"C$ & 5D :


13/17

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):$? ,;@,A@&( B"C$ : 5D :


14/17

NFLPA_BRADY001615CONFIDENTIAL

!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):, 3 ,;?,@?&( A"B$ & 5C @


15/17

CONFIDENTIAL

Page 2

10:54:-- A-61 Text Message from

Jastremski

-----

1/19/2015

10:55:--

A-61 Text Message from

Jastremski

----- 1/19/2015

10:55:32

105 Text Message Jastremski Brady -----

1/19/201510:59:-- A-61 Text Message toJastremski ----- 1/19/201510:59:32 105 Text Message Brady Jastremski -----

1/19/2015

17:21:--

A-43 Phone Call to

Schoenfeld

9 min 1/19/2015

“later that day”

105

n.65

Phone Call Brady Schoenfeld -----

1/19/2015

14:38:--

A-62 Text Message to

Jastremski

----- 1/19/2015

14:38:09

105 Text Message Brady Jastremski -----

1/19/2015

14:38:--


Jastremski

----- 1/19/2015

14:38:17


1/19/2015

14:38:--


Jastremski

----- 1/19/2015

14:38:34


1/19/2015

17:20:--


Jastremski

----- 1/19/2015

17:21:23


1/19/2015

17:21:34

107 Phone Call Jastremski Brady 00:00:28

1/19/2015

17:27:06


1/19/2015

17:29:--

A-43 Phone Call to

Jastremski

12 min 1/19/2015

17:30:03

107 Phone Call Brady Jastremski 00:11:01

1/20/2015

07:24:--


Jastremski

----- 1/20/2015

07:24:47


1/20/2015

08:22:--

A-43 Phone Call to

Jastremski

7 min 1/20/2015

“within thehour”

108 Phone Call Brady Jastremski 00:06:21

1/20/2015

17:13:--


Jastremski

----- 1/20/2015

17:13:38


1/20/2015

17:27:--

A-43 Phone Call from

Jastremski

4 min 1/20/2015

“less than

fifteen minutes

later”



!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):, 3 ,;?,@?&( A"B$ : 5C @


16/17

CONFIDENTIAL

Page 3

(~17:28)

1/21/2015

07:27:--


Jastremski

----- 1/21/2015

07:27:48


1/21/2015

07:38:--


Jastremski

14 min 1/21/2015

“starting at

7:38 a.m.”

(~07:38)

109 Phone Call ----- ----- 00:13:47

1/21/2015

11:45:--


Jastremski

7 min 1/21/2015

11:45:16

109 Phone Call ----- ----- 00:07:05

02/03/2015

18:18:--


Schoenfeld

-----

02/03/2015

18:20:--


Schoenfeld

-----

02/03/2015

18:21:--


Schoenfeld

-----

02/03/2015

18:22:--


Schoenfeld

-----

02/03/201518:23:--

A-68 Text Message toSchoenfeld

-----

02/04/201508:26:--

A-68 Text Message toSchoenfeld

-----

02/04/201508:26:-- A-68 Text Message fromSchoenfeld -----

02/05/2015

09:54:--


Schoenfeld

-----

02/05/2015

09:54:--


Schoenfeld

-----

02/05/2015

15:46:--


Schoenfeld

-----

02/05/2015

16:21:--


Schoenfeld

-----


!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):, 3 ,;?,@?&( A"B$ C 5D @


17/17

CONFIDENTIAL

Page 4

02/07/2015

18:21:--


Jastremski

-----

02/07/2015

18:21:--


Jastremski

-----

02/07/201518:33:-- A-74 Text Message fromJastremski -----

02/25/2015

18:09:--

39 Phone Call to

Jastremski

4 min


!"#$ &'&()*+),(-&.)/01)2!3 45*67$89 :;):, 3 ,;?,@?&( A"B$ @ 5C @