# Ring Doorbell Data Analysis — Personal Information Export

**Prepared:** Jul 8, 2026
**Source:** Ring account data export from ~/Downloads/All Data Categories/ (downloaded Jul 7-8, 2026)
**Account:** Matthew McAchran (mattmcachran@gmail.com)
**Device:** Front Door Video Doorbell 2 (ID: 587a62462bd1)

---

## 1. Account & Device Overview

- **Account created:** 2019-04-09 (original Ring account, pre-dates current device)
- **Amazon account linked:** 2022-03-28 (Sidewalk not enabled)
- **Device installed:** 2022-03-20 at 417 Charles Conner Dr, Kernersville, NC 27284
- **WiFi SSID:** mcachran (WPA2-Personal, channel 1/6/11)
- **Subscription:** Ring Solo ($49.99/yr, renewed Apr 22, 2026 through Apr 22, 2027)
- **Trial period:** Canceled (ring-trial, 2022)
- **Previous location:** Stokesdale — 331 Twin Creeks Dr (old address)
- **Personalized advertising:** Enabled
- **Passkey:** Created 2025-05-24 on iPhone (iOS 18.5)

### Devices & Sessions (from Device and Session Information.csv)

| App Type | Device | First Seen | Notes |
|----------|--------|------------|-------|
| ring (iOS) | iPhone 15,3 | 2022-03-20 | iOS 18.4.1, Ring app v5.84.0 |
| ring (iOS) | iPhone 17,2 | 2025-05-24 | iOS 26.5, Ring app v5.106.1 — current phone |
| ring (Android) | ring-doorbell:CaseApp/1.0 | 2026-05-24 | Android app, 3 login events |
| ring (Web) | HeadlessChrome/148.0.0.0 | 2026-05-24 | Automated scraping tool — multiple sessions |
| ring (Web) | Chrome 149 | 2026-07-02 | macOS, recent login |
| neighborhoods (iOS) | iPhone 15,3 | 2023-04-30 | Neighbors app |

### HeadlessChrome Sessions (Scraping Activity)

May 24-25, 2026 — 6 recorded sessions of "HeadlessChrome/148.0.0.0" on macOS:
- 2026-05-24T20:05:57Z (4:05 PM EDT)
- 2026-05-24T20:08:17Z (4:08 PM EDT)
- 2026-05-24T20:09:55Z (4:09 PM EDT)
- 2026-05-24T20:11:18Z (4:11 PM EDT)
- 2026-05-25T16:07:24Z (12:07 PM EDT)
- 2026-05-25T16:36:25Z (12:36 PM EDT)

These correspond to the automated scraping/data download tool accessing the Ring account.

---

## 2. Shared Video Links — STILL LIVE (As of Jul 8, 2026)

Four videos were shared via link from the incident night (April 14, 2026). All share pages confirmed accessible — each page renders a `<video>` tag sourced from Ring's S3 bucket (filestore-unlimited-211125648849-us-east-1-prod-data).

| # | Share Timestamp (UTC) | Time (EDT) | URL | Status |
|---|----------------------|------------|-----|--------|
| 1 | 23:44:33 | 7:44 PM | ring.com/share/9cafcd81-b8db-471f-94ab-9b5c8ff17b58 | ✅ LIVE — S3 video source present |
| 2 | 23:48:43 | 7:48 PM | ring.com/share/da44041a-5570-412e-8e1c-0fd2f14bf9d7 | ✅ LIVE |
| 3 | 23:50:55 | 7:50 PM | ring.com/share/a6d2562b-e504-42cd-952f-3be65cfde657 | ✅ LIVE |
| 4 | 23:57:23 | 7:57 PM | ring.com/share/e0d62d61-2358-4e0c-838a-9a483e35ee2b | ✅ LIVE |

**5th share** (old, Nov 18, 2023): ring.com/share/18201bbe-edde-465a-bcce-973cec000d5c (shared via email — pre-incident clip)

### Significance
These share links were created hours after the KPD incident on April 14. The timestamps suggest someone was accessing and sharing Ring footage starting around 7:44 PM EDT — which is after the police encounter but before any arrest/warrant. This timeline could be relevant for establishing:
- Who had access to the Ring account post-incident
- What footage was being reviewed/shared
- Whether the shared clips capture the police encounter, aftermath, or unrelated activity

---

## 3. App Activity Analysis (app_events.zip — 79 daily CSVs)

### Data Structure
Each CSV contains columns: `Event, Timestamp, Properties` — tracking every user interaction with the Ring iOS/Android app.

### Daily Activity Volume (by file size)

| Size Range | Dates | Notable |
|------------|-------|---------|
| >1MB | Apr 15 (1.3MB), May 9 (1.1MB) | **Peak activity days** |
| 100-500KB | Apr 8, 9, 10, 18, 25-29, May 1, 3, 5, 7, 12, 14, 19, Jun 2, 3, 6, 10, 11, 15, 17, 22, 28, 30 | Moderate |
| <10KB | Apr 17, Jun 20 | Minimal |
| 0B | May 17 | No data |

### April 15 (Warrant Execution Day) — 1.3MB, 3,309 rows

**Highest-activity day in the entire 79-day dataset.**

Key events:
- **1,365** App Network Request — constant polling/network activity
- **499** Loop Products Fetched — refreshing camera data
- **148** App UI Navigated — intensive app navigation
- **105** View LoadingTime
- **53** Timeline ViewedEvent — reviewing recorded event history
- **30** History ThumbnailLoading
- **29** Rich Notification Received — push notifications arriving
- **21** App Opened / 21 App Launched — app opened repeatedly
- **21** Timeline Opened / 21 Timeline Closed
- **18** WebRTC Playback ConnectionClosed — **watching recorded video playback**
- **16** Live Preview Attempted — trying to view live camera feed
- **4** Sharing TappedShareIcon / 4 Sharing PreparedVideo
- **3** Sharing SharingEventCompleted / 3 Sharing SelectedShareMethod
- **6** Timeline ScrubbedFootage — scrubbing through recordings

**Interpretation:** On the day the search warrant was executed (Apr 15), someone was intensely using the Ring app — viewing recorded history, watching video playback, attempting live preview, and sharing videos. This could be the defendant monitoring/collecting evidence, or someone else accessing the account.

### April 14 (Incident Day) — 45KB, 116 rows

Relatively quiet day:
- 71 App Network Request
- 8 SnapshotPoller Result (periodic snapshots)
- 8 Loop Products Fetched
- 8 Devices DidLoadList
- 8 App Credentials Persist
- 8 Session Finished

No timeline viewing, no live preview, no video playback. The app was not actively used during the incident itself.

### May 8 (Arrest Warrant Filed) — 209KB, 530 rows

Moderate activity:
- 242 App Network Request
- 45 Loop Products Fetched
- 13 Timeline ViewedEvent
- Minimal video playback

### May 9 (Day After Warrant Filed) — 1.1MB, 2,843 rows

**Second-highest activity day.** Heavy engagement:
- 1,132 App Network Request
- 252 Loop Products Fetched
- 162 App UI Navigated
- 30 Timeline ViewedEvent
- 28 Session Foregrounded / 27 Session Backgrounded
- 24 WebRTC Playback ConnectionClosed — watching recorded video
- 20 Live Preview Attempted
- 18 CameraTile Click
- 22 Timeline Opened / 24 Timeline Closed
- Extensive LiveView activity (7 sessions, microphone permissions, volume adjustments)

### May 11 (Arrest Day) — 127KB, 321 rows

Relatively quiet:
- 125 App Network Request
- 28 Loop Products Fetched
- 11 Rich Notification Received
- Minimal timeline/video activity

### May 12 (Bond/SBI Fingerprint Day) — 476KB, 1,202 rows

Heavy event history browsing:
- 481 History ThumbnailLoading — browsing thumbnails
- 155 Timeline ViewedEvent
- 37 Timeline ScrubbedPill
- 12 Sharing PreparedVideo — preparing to share videos
- 12 Event Download — **downloading events from the app**
- 9 Timeline ScrubbedFootage

---

## 4. Device Online/Offline Activity (DeviceEvents.csv)

Daily overnight offline cycles (approx 2:30-8:30 AM EDT) followed by morning reconnection — consistent with WiFi router cycling or device power management.

**Notable dates:**
- Apr 14: Online 07:38 UTC → Offline 07:38 UTC, Online 07:38 UTC (normal cycle before incident)
- Apr 15: Online 06:18 → Offline 06:18, Online 12:15 → Offline 12:15, **Online 18:23 → no offline recorded until next day** (device stayed online through the evening)
- Apr 25: Offline 21:50 → Online 21:56 (4-min gap, possibly reboot)
- Apr 11: Offline 22:38 → Online 22:40 (2-min gap), then offline 22:44 → online 22:44

---

## 5. Motion/Ding Events (Events.csv)

The Events.csv (259 rows) contains motion detection and on-demand viewing events from the doorbell, primarily from Jun-Aug 2026. Notable:

- **Event types**: `motion` (detected movement), `ding` (doorbell pressed), `on_demand` (user-initiated live view)
- **Status**: Most motion events `timed_out`; on-demand events marked `completed`
- **Duration**: Motion events range 8-34 seconds
- **Encryption**: No end-to-end encryption on any events
- **Human detected**: "Not Applicable" on all — person detection metadata not in this export

**Notable density**: June 3 (25 events), June 5 (11 events evening), June 20 (7 events), June 17 (13 events) — typical summer activity.

---

## 6. Neighbors GeoSearch Alert Areas

Two geofence alert areas defined:
1. **Stokesdale** (27357-8660) — centered at 36.285, -79.947 (old address), created Mar 2024
2. **Kernersville** (27284) — centered at 36.103, -80.077 (current address), created Mar 2022

---

## 7. Subscription & Accounting

- **Ring Solo plan** covers 1 device (Front Door) at Rental location
- **Renewal**: Apr 22, 2026 ($49.99/year, auto-renew through Apr 2027)
- **Previous plan**: Home Basic ($49.99/year, 2024-2025)
- **Payment**: Invoice 75C4EEB7-0007
- **Sidewalk**: Not enabled
- **Amazon/Account linked**: Yes (since Mar 28, 2022)

---

## 8. Notifications Configuration

Two active notification subscription profiles (motion + ding events, low battery alerts), with 6 disabled profiles. Alert volume set to 0.0 (silent) on all. Three active subscriptions, five disabled.

---

## 9. Third-Party Service Providers

- **Personalized advertising**: Enabled
- **Analytics**: Heap Analytics, Optimizely enabled
- **Other**: Kenshoo (ad tracking), Sizmek (ad serving), Amazon Display Ads

---

## 10. Key Legal Implications

1. **Shared video links are still live** — the 4 incident-night clips may contain visual/audio evidence of the KPD encounter at 417 Charles Conner Dr

2. **Apr 15 was the most active app day** — 3,309 events with video playback, timeline review, and sharing. If the defendant was in custody (warrant executed Apr 15 morning), who was using the app?

3. **May 12 shows "Event Download" activity** — someone used the Ring app to download recorded events. If these were the incident recordings, the downloaded files may exist on the user's device.

4. **HeadlessChrome access on May 24-25** — confirms automated scraping tool accessed the Ring account, likely the same tool that produced this data export

5. **RingVacs export was empty** — the actual video event recordings (motion-triggered clips) were NOT included in the data export. Only metadata about the events exists in Events.csv/app_events.