State Exhibit S 10 Mowery

Latah County Prosecuting Attorney Supplemental Report 22-M09903
SUPPLEMENTAL NARRATIVE:

Supplement number: 21
Reporting Officer: Lawrence Mowery
Date: 15:40:18 11/17/22 Cell Phone Warrants Case # 22-M09903
Date: 11/17/2022 On November 16, 2022, I applied for and was granted the following warrants for the cell phone providers serving the area around 1122 Kings Road in Moscow, Idaho:
AT & T

11760 U. S. Highway 1, Suite 300 North Palm Beach, FL 33408-3029 For a tower dump of all records and unique device / user identifiers pertaining to Timing Advance, Real Time Tool (RTT), Location Database of Record (LocDBOR) location information during the following listed dates, times and geographical boundaries (distance from GPS points):
GPS Coordinates: 46.721960, -117.010790 Distance from Location: 0.50 miles
Date: November 13, 2022 Time: 3:00 a. m. 5:00 a. m. (PST) This warrant was served at approximately 1009 hours via email atgldc@att.com.

For the AT & T Call Detail Records (CDR) for the following phone accounts:
AT & T Wireless Number: ████████ 1278 AT & T Wireless Number: ████████ -1224 AT & T Wireless Number: █████████ -7846 This warrant was served at approximately 0922 hours via email atgldc@att.com.

Verizon Wireless
Attn: Custodian of Records 180 Washington Valley Road Bedminster, NJ 07921 For a tower dump or all records and unique device / user identifiers pertaining to Timing Advance, Real Time Tool (RTT), Location Database of Record (LocDBOR) location information during the following listed dates, times and geographical boundaries (distance from GPS points):
GPS Coordinates: 46.721960, -117.010790 Distance from Location: 0.50 miles
Date: November 13, 2022 Time: 3:00 a. m. 5:00 a. m. (PST) And for the Verizon Call Detail Records (CDR) for the following phone accounts:
Verizon Wireless Number: ████████ 1841
Verizon Wireless Number: ███████ -3185
Verizon Wireless Number: ███████ -2881 exhibitsticker.com /sds/app/force/uprt/lwsupl.x1 01/10/23 000132

Supplemental Report 22-M09903 Page 2 of 2 This warrant was served at approximately 0935 hours via fax 888-67-0026.

T-Mobile
Attn: Law Enforcement Relations Group 4 Sylvan Way Parsippany, NJ 07054[REDACTED:US_SOCIAL_SECURITY_NUMBER]@T-Mobile.com For a tower dump of all records and unique device / user identifiers pertaining to Timing Advance, Real Time Tool (RTT), Location Database of Record (LocDBOR) location information during the following listed dates, times and geographical boundaries (distance from GPS points):
GPS Coordinates: 46.721960, -117.010790 Distance from Location: 0.50 miles
Date: November 13, 2022 Time: 3:00 a. m. 5:00 a. m. (PST) This warrant was served at approximately 1029 hours via email lerinbound@T-Mobile.com.

For the T-Mobile Call Detail Records (CDR) for the following phone accounts:
T-Mobile Wireless Number: ███████ -4818
T-Mobile Wireless Number: ███████ 3-4782 This warrant was served at approximately 0942 hours via email lerinbound@T-Mobile.com.

Inland Cellular 960 West Pullman Road Moscow, Idaho 83843 For a tower dump of all records and unique device / user identifiers pertaining to Timing Advance, Real Time Tool (RTT), Location Database of Record (LocDBOR) location information during the following listed dates, times and geographical boundaries (distance from GPS points):
GPS Coordinates: 46.721960, -117.010790 Distance from Location: 0.50 miles
Date: November 13, 2022 Time: 3:00 a. m. 5:00 a. m. (PST) This warrant was served at approximately 1044 hours via email tawnya@inlandcell.com.

Det. Lawrence Mowery-162 Thu Nov 17 15:40:23 PST 2022 Reviewed:
Sgt. J. W. Lawrence Thu Nov 17 18:26:47 PST 2022 /sds/app/force/uprt/lwsupl.x1 01/10/23 000133

Latah County Prosecuting Attorney Supplemental Report 22-M09903
SUPPLEMENTAL NARRATIVE:

Supplement number: 22
Reporting Officer: Lawrence Mowery
Date: 17:19:10 11/17/22 Alivea Goncalves Files Case # 22-M09902
Date: 11/17/2022 On November 15, 2022, I received and email from Steve Goncalves, the father of Kaylee Goncalves. He stated he had access to some of Kaylee's messages and phone calls. Steve stated he would have his other daughter, Alivea, contact me about those files.

I was able to speak to Alivea and she sent me various files, including an image from the Spokesman Review showing a camera on a nearby residence, text messages between Kaylee and Jack Decouer, text messages between Kaylee and her Uber driver █████ a recent phone call list, and video from the Grub Truck Twitch.tv feed.

I attached these files to the case file. The communication between Kaylee and Decouer was located on Decouer's phone examinationand the Twitch feed was previously downloaded.

In the image showing the camera, it was found that residence was at 1112 King Road. The SDCard from the camera was brought to the Moscow Police Department, but was the file system of the card was not recognized by any of the forensic computers. The card was returned to the owner and reinstalled into the camera.

On November 17, 2022, Ofc John Rosinsky re-contacted the owner of the camera,
████████████ via phone. ██████ stated she was out of town, but sent a video to Ofc Rosinsky showing a figure walk to the dumpster and appear to look inside.

To preserve any potential evidence on the camera, I asked ██████ if we could seize the entire device, including the SDCard, to which she stated yes. ██████
stated she would not be back in Moscow until approximately November 28, 2022. I directed ██████ to contact me when she returns to her residence, at which time I will attempt to connect the camera back to her WIFI router and view video from the device.

Det. Lawrence Mowery-162 Thu Nov 17 17:19:19 PST 2022 Reviewed:
/sds/app/force/uprt/lwsupl.x1 01/10/23 000134

Supplemental Report 22-M09903 Page 2 of 2 Sgt. J. W. Lawrence Fri Nov 18 09:09:14 PST 2022 /sds/app/force/uprt/lwsupl.x1 01/10/23 000135

Latah County Prosecuting Attorney Supplemental Report 22-M09903
SUPPLEMENTAL NARRATIVE:

Supplement number: 23
Reporting Officer: Lawrence Mowery
Date: 11:36:47 11/18/22 Preservation Facebook 7370025 Case # 22-M09903
Date: 11/18/2022 On November 18, 2022, I received and email from Alivea Goncalves showing a screenshot of a Facebook post from Dylan Mortensen. In the post the account, the user name was ███████████████ reported details about the incident. I searched for this user and found a userID of █████████████ This account had an avatar similar to the Mortensen avatar.

I was able to pull up the account and it appeared to have the following friends
████████████ associated with ██████████████████████████████████ it:
I ██████████████ requested preservation on all four (4) of these accounts. At approximately 0745 hours, I received an email from Facebook stating the accounts were preserved.

Det. Lawrence Mowery 162 Fri Nov 18 11:36:51 PST 2022 Reviewed:
Sgt. J. W. Lawrence Fri Nov 18 14:01:58 PST 2022 /sds/app/force/uprt/lwsupl.x1 01/10/23 000136

Latah County Prosecuting Attorney Supplemental Report 22-M09903
SUPPLEMENTAL NARRATIVE:

Supplement number: 24
Reporting Officer: Lawrence Mowery
Date: 12:06:50 11/18/22 Twitch Video Case # 22-M09903
Date: 11/18/2022 On November 13, 2022, I was informed two of the victims had been patrons at the Grub Truck, located on Main Street in Moscow, Idaho. I was also informed Grub Truck streams live feeds of their customers and sales via Twitch.tv.

I was able to locate the Twitch account " GrubTruckers " and locate the stream from the November 12-13, 2022. This stream was labelled, " The Carbonara effect... we'll never reveal our secret ingredient " and located at https://www.twitch.tv/videos/1651413498.

In the video, Kalyee Goncalves and Maddie Mogen are seen walking into camera view on the video at 3:43:01 timestamp. They are accompanied by a male, later identified as John " Jack " Showalter. Goncalves orders and receives food.

At the 3:53:31 timestamp, the girls are seen walking around the truck and leave the area. Showalter appears to be talking to another patron and does not see the girls leave. Showalter then raises his arms in a " What? " fashion and walks away in a different direction than the girls.

A copy of this video was captured and saved as evidence.

Det. Lawrence Mowery-162 Fri Nov 18 12:06:54 PST 2022 Reviewed:
Sgt. J. W. Lawrence Fri Nov 18 14:02:37 PST 2022 /sds/app/force/uprt/lwsupl.x1 01/10/23 000137

Latah County Prosecuting Attorney Supplemental Report 22-M09903
SUPPLEMENTAL NARRATIVE:

Supplement number: 26
Reporting Officer: Lawrence Mowery
Date: 10:06:25 11/19/22 Uber Location Request Case # 22-M09903
Date: 11/18/2022 On November 18, 2022, I logged into the Uber Law Enforcement Portal (lert.uber.com) and submitted an exigent preservation request for any location data associated with the Uber driver named ██████████ with the phone number of
████████ 1-6059. Due to the nature of the investigation, Uber recommended an exigency request for the preservation.

In a screen shot received from Alivea Goncalves, it showed messages which appear to be from ██████ phone between Kaylee Goncalves and himself. The name of the recipient is " Kaylee Uber. " It is unknown if █████ was " on duty " with Uber at the time of him picking up Goncalves and Maddie Mogen. Uber stated if the driver was " on duty " it would show the location of the vehicle. If the driver was not " on duty, " Uber would not have the data. I was informed by Uber Customer Service this is common if the driver provides personal transportation services.

At 1434 hours, I received an email from Uber stating they received my request.

I received an email at approximately 1617 hours from Uber, which contained files regarding the Uber logs of ██████████ The records showed his location up until approximately 0115 hours, where it appears no other information is found and
█████ goes " off duty. " These records were attached to the case file. No warrant was requested or returned as Uber provided the data via the exigent request.

Det. Lawrence Mowery 162 Sat Nov 19 10:07:50 PST 2022 Reviewed:
Sgt. J. W. Lawrence Sun Nov 20 06:05:44 PST 2022 /sds/app/force/uprt/lwsupl.x1 01/10/23 000140

Latah County Prosecuting Attorney Supplemental Report 22-M09903
SUPPLEMENTAL NARRATIVE:

Supplement number: 27
Reporting Officer: Lawrence Mowery
Date: 11:13:52 11/19/22 Devices to PFPD Case # 22-M09903
Date: 11/18/2022 On November 17, 2022, I contacted Det Neil Uhrig of the Post Falls Police Department for assistance in examining the laptops and iPad located in the residence at 1122 King Road.

Det Uhrig arrived at the Moscow Police Department and received the following evidence item numbers:
22M-1808 Apple Laptop 22M-1809 Apple Laptop 22M-1844 Apple Laptop 22M-1845 Apple Laptop 22M-1846 Dell Laptop 22M-1848 Dell Laptop 22M-1849 Apple iPad Det. Lawrence Mowery 162 Sat Nov 19 11:14:05 PST 2022 Reviewed:
Sgt. J. W. Lawrence Sun Nov 20 06:08:32 PST 2022 /sds/app/force/uprt/lwsupl.x1 01/10/23 000141

Latah County Prosecuting Attorney Supplemental Report 22-M09903
SUPPLEMENTAL NARRATIVE:

Supplement number: 28
Reporting Officer: Lawrence Mowery
Date: 18:55:26 11/19/22 1112 King Video Case # 22-M09903
Date: 11/19/2022 On November 13, 2022, I was informed of a possible surveillance camera located at 1112 King Road. Cpl Ryan Snyder had spoken with one of the residents at this location, ████████████ who had a camera using the Homeye Pro app on the porch of their dwelling.

Cpl Snyder provided me with the username and password for the Homeye Pro account associated with ██████ I asked Cpl Snyder if this video was stored on a cloud-based system for me to view or if could download a copy of the video.

I was provided a 32GB SDCard from the camera, but the file format was not recognized by any of my forensic computers and prompted me to format the disk.

Cpl Snyder informed me ██████ could screen capture the video from her phone, and the card was returned to ██████ to enable her to assist in the acquisition of the data.

On November 17, 2022, I requested the assistance of Ofc John Rosinsky to recontact ███████ and see if she could provide the video from the camera. Ofc Rosinsky contacted ███████ who stated she was in Boise, Idaho until November 28,
2022. Ofc Rosinsky ██████ sent him a video of a male subject walking by the camera at approximately 0320 hours towards the dumpster on Ofc Rosinsky contacted me and I spoke to ██████ and requested permission to remove the camera from the residence and she consented.

Based on my training and experience I know many of the different video surveillance cameras use a First-In, First-Out storage retention system. This means the newer data overwrites the older data. I was concerned data may be lost the longer the camera continued to record footage. I requested assistance from Ofc Aaron Morris to go to the residence and unscrew the camera from its location. The camera screws into a common light bulb base, commonly found on patio / porch fixtures. Ofc Morris returned a short time later with the camera and the SDCard.

On November 18, 2022, I again attempted to view the contents of the SDCard, I plugged the card into a write-blocker and it still was not recognized by the computer. I used FTK Imager version # 4.7.1.2 to make an image of the SDCard. Now /sds/app/force/uprt/lwsupl.x1 01/10/23 000142

Supplemental Report 22-M09903 Page 2 of 2 that the data was on a drive recognized by the operating system, I then used Axiom Magnet version # 6.5.0.32778 to parse data from the card.

In reviewing the data, I found over 13,000 individual images from the card. They appear to be individual video frames from the camera.

While attempting to view the data on the card, I received a forwarded email from
████████████ whose sister ██████████ resides at the residence. The email stated that he was viewing the video remotely when Ofc Morris removed the camera. He stated he saw a suspicious vehicle in the area and was concerned with the video footage stored on the device being overwritten.

I was then put in touch with ███████████ another resident at 1112 King Road.

█████ stated she would be back in Moscow at approximately 2000 hours. I met with
████ at her residence and asked again if she would be willing to assist in recording screen captures on her phone from the device. I explained to ████ I would replace the camera, gather the information and then take the camera as evidence. I also explained to █████ I needed to take the wireless router, since the camera was already linked to the WIFI network. ████ stated she would consent and allow both items to be seized.

I reinstalled the camera in the light socket and it powered on. I was able to watch as ████ accessed the footage on the camera. During this time, the camera showed a vehicle entering the area at approximately 0356 hours and leaving at a high-rate of speed at approximately 0420 hours. ████ provided the videos to me.

I uninstalled the camera and seized the wireless router. Both items were then taken back to the Moscow Police Department as evidence.

On November 19, 2022, while reviewing the videos located at 0356 and 0420, it appeared the vehicle left the area and may have travelled on Walenta Drive, however, the video stopped. In an attempt to see further, and gain perhaps a better resolution, I reconstructed the wireless network the camera operated on by powering on the wireless router. I downloaded the Homeye Pro app on my work phone.

I was able to use the app and download the video clips. These clips included audio, which were not a part of the screenshots completed and were able to capture a longer duration. In the clips, the vehicle's exhaust and acceleration can be heard, as well as seeing the vehicle leave at a high rate of speed on Walenta Drive.

After capturing the clips, I disconnected the camera and wifi router and placed them into evidence. The videos were placed onto a DVD and placed into evidence.

Det. Lawrence Mowery 162 Sat Nov 19 18:55:33 PST 2022 Reviewed:
Sgt. J. W. Lawrence.

Sun Nov 20 06:12:47 PST 2022 /sds/app/force/uprt/lwsupl.x1 01/10/23 000143

Latah County Prosecuting Attorney Supplemental Report 22-M09903
SUPPLEMENTAL NARRATIVE:

Supplement number: 40
Reporting Officer: Lawrence Mowery
Date: 13:38:16 11/28/22 Router Interrogation Case # 22-M09903
Date: 11/15/2022 On November 13, 2022, I responded to 1122 King Road in Moscow, Idaho in an attempt to interrogate the wireless router located at this residence. After speaking with Cpl Brett Payne, he informed me the wireless router and cable modem were located in the living room on the second floor.

After arrival, I used an ethernet cable to connect my laptop to the Local Area Network (LAN) ports on the back of the Spectrum WiFi 6 router with the Serial # 60SA2203000B752. The router then provided my laptop with an IP address and Gateway IP, which resolved to the router.

I attempted to locate a web-based management portal for the device but was prompted to download the Spectrum app and use the account username and password to access the device. I contacted Spectrum technical support and found this was the only way for the client to access the data on the device.

I then called the Charter Law Enforcement Response Team (LERT) and spoke with a representative and tried to ascertain if Charter / Spectrum could retrieve data from the router via their diagnostic portal. After several days and phone calls to Charter, I spoke with ██████████████ the manager of the Legal Response Operations Center. ███████ stated her team was working on verifying if the router hardware was able to be accessed.

On November 17, 2022, I again called Charter and left a voicemail. ███████
returned my phone call and stated her technicians were able to access and download the data from the router, however, the did not preserve the correct timeframe specified in my request. I was told she would have her technicians retry and preserve the data.

On November 17, 2022, I again called Charter and left a voicemail for ███████ I received a call back from ███████ who stated the technicians were able to retrieve data for the time periods of September 14, 2022 to November 7, 2022 and November 11, 2022 to November 14, 2022. I was informed there was a problem with their cloud services and that resulted in the data loss for November 8-10. I informed ███████ I would be applying for a warrant and requesting that data with the legal process.

/sds/app/force/uprt/lwsupl.x1 01/10/23 000163

Supplemental Report 22-M09903 Page 2 of 2 From my training and experience, I know wireless routers (WIFI routers) allow wireless devices (phones, tablets, laptops, etc) to connect to them for access to the internet or other devices on the local area network (LAN). During this process, after a device has successfully connected to the wireless router, a log of this connection, and the specific MAC address (Media Access Control) of each device, is kept on the device. If a user previously selected the " connect automatically " setting while connecting to the wireless router, which is a common default setting, the device will connect to the router automatically without any user input. These devices would have to be in close proximity of the router to be shown on the MAC address log.

The data previously stored on the wireless router, located at 1122 King Road, and preserved by Charter / Spectrum, may show individual MAC addresses of devices connected to the device. If the suspect had previously connected to the wireless router, was in close proximity to the wireless router located in the residence, this device may have automatically connected and appear on the MAC address logs.

This could provide evidence of when a device was in close proximity of the router on the night Madison Mogen, Kaylee Goncalves, Xana Kernodle and Ethan Chapin were murdered.

I requested the assistance of the Latah County Prosecutor's Office in applying for a warrant to serve on Charter for the data records preserved and s