Device
MacBook Pro 14" (2023) · Serial: C02XXXXXXX · Hostname: ANANYA-CTO-LAPTOP · Seized under warrant, Friday 11:30 AM · Chain of custody confirmed
Document Creation — "farewell_v2.docx"
| Event | Timestamp | Detail |
|---|
| File created | Thursday 21:14:33 | Microsoft Word process (PID 4421). Application was running in background — not the active foreground application at time of creation. File saved to: /Users/ananyarao/Documents/Personal/farewell_v2.docx |
| File last modified | Thursday 21:16:02 | 1 min 29 sec total editing time logged by Word |
| File converted to PDF | Thursday 21:16:44 | Output: farewell_v2.pdf · Saved to same directory |
| PDF file transferred via AirDrop | Thursday 21:18:02 | AirDrop target device hostname: REDACTED · File: farewell_v2.pdf |
Remote Desktop Activity — Thursday Night
| Timestamp | Event | Target Hostname |
|---|
| 23:27:11 | Microsoft Remote Desktop — connection initiated | RMEHT-CEO-DESK (Rohan Mehta's workstation) |
| 23:29:44 | RDP session authenticated and active | RMEHT-CEO-DESK |
| 23:32:51 | RDP session terminated | RMEHT-CEO-DESK |
Other Activity — Thursday 21:00–24:00
| Time | Activity |
|---|
| 22:47 | GitHub Desktop application: commit "delete bridge module" pushed to payspark-internal/fraud-engine. Account: aro_cto. |
| 23:05–23:27 | Device idle — no active application events logged |
| 23:27–23:32 | Remote Desktop session (see above) |
| 23:34 | Device screen locked |