# Ring App Events Analysis

## Source

`~/Downloads/All Data Categories/datarequest/ring_mobile_data/app_events.zip` — 79 daily CSV files (`app_brand_app.csv`) spanning Apr 4 – Jul 1, 2026. Extracted to `case-files/tmp/app_events/`.

## Event Types

Each CSV has columns: `Event`, `Timestamp`, `Properties` (malformed CSV — first field is partial JSON, remaining fields are non-standard `Key:Value` pairs).

## Overall Activity By Date

| Date | Events | Event Types | Prominent Activity |
|------|--------|-------------|-------------------|
| Apr 14 | 115 | 7 | Network requests, credential persist — low activity |
| **Apr 15** | **3,308** | **66** | **HIGHEST DAY — warrant execution** |
| Apr 28 | 2,477 | 61 | Timeline scrubbing (while in custody) |
| May 8 | 529 | 42 | Arrest warrant signed |
| **May 9** | **2,842** | **70** | **Second highest — day before bond posted** |
| May 11 | 320 | 50 | Bond posted |
| May 12 | 1,201 | 58 | Event downloads (12 clips saved) |

## April 15 (Warrant Execution) — Deep Dive

**3,308 events** — highest of any day in the 3-month dataset.

Key event types:
| Event | Count |
|-------|-------|
| App Network Request | 1,365 |
| Loop Products Fetched | 499 |
| App UI Navigated | 148 |
| View LoadingTime | 105 |
| Permission Request | 84 |
| CMM Content Requested | 83 |
| Devices DidLoadList | 67 |
| Content View | 63 |
| Timeline ViewedEvent | 53 |
| Timeline LoadingState Thumbnail | 49 |
| Screen View | 45 |
| Rich Notification Received | 29 |
| App PushNotification TokenUpdated | 42 |
| Video Call Incoming | 18 |
| Live View Started | 16 |

**Key finding**: 18 video playback sessions + 16 live preview attempts + active video sharing. This is consistent with someone using the Ring app heavily on the day of the warrant execution — either the defendant checking footage, or someone else (police? family?) accessing the account.

**Timeline**: First event 02:57:43, last 23:39:44 — almost the entire day.

## April 28 — Deep Dive

**2,477 events** — third highest. **Dominant activity: Timeline scrubbing.**

| Event | Count |
|-------|-------|
| App Network Request | 771 |
| Timeline ViewedEvent | 674 |
| Timeline LoadingState Thumbnail | 636 |
| Timeline ScrubbedPill | 100 |
| Devices DidLoadList | 47 |
| Timeline ScrubbedSession | 22 |
| Timeline ScrubbedFootage | 21 |

**Activity is extremely concentrated**: 577 of 674 Timeline ViewedEvents (86%) occurred between 19:00-20:00 (7-8 PM). The peak minute was 19:51 (172 views in 60 seconds).

**Interpretation**: Someone spent the evening of April 28 systematically scrubbing through Ring video history, viewing past events. Since Matthew was never incarcerated and voluntarily turned himself in to the magistrate on May 11, this was normal personal use of his own phone and Ring account — possibly reviewing the April 14-15 footage in preparation for his legal case.

## May 8 — Arrest Warrant Issued

**529 events**. Moderate activity. 13 Timeline ViewedEvents, 6 Timeline ScrubbedFootage. This is the day the misdemeanor arrest warrant was signed by Magistrate Weiner.

## May 9 — Pre-Release Heavy Activity

**2,842 events** — second highest day. High activity across all categories:
- App Network Request: 1,132
- Loop Products Fetched: 252
- App UI Navigated: 162
- View LoadingTime: 105
- Timeline Opened: 27
- Timeline ViewedEvent: 30

## May 11 — Bond Posted

**320 events** — relatively low. Bond was posted and defendant released.

## May 12 — Event Downloads

**1,201 events**. Key activity:
- History ThumbnailLoading: 481
- Timeline ViewedEvent: 155
- Event Download: **12** (the all-clips were downloaded to the phone on this date)
- Sharing PreparedVideo: **12** (same 12 clips prepared for sharing)
- Timeline ScrubbedPill: 37
- Item Click: 27

## Device Fingerprinting

Same device throughout ALL dates:
- **Model**: iPhone17.2 (iPhone 17 Pro Max)
- **OS**: iOS 26.3.1
- **Hardware ID**: 2588D45D-F17E-4B77-A662-53664DE0E888 (never changes)

### IP Address Changes

| Date | Primary IP | Interpretation |
|------|-----------|----------------|
| Apr 14 | 174.220.97.79 | Home network / cellular (pre-incident) |
| Apr 15 | **76.36.192.99** | Home WiFi (warrant execution — phone at residence) |
| Apr 28 | **76.36.192.99** | Home WiFi (phone at home, NOT seized) |
| May 8 | 174.196.11.128 | Different network |
| May 9 | 174.196.15.165 | Different network (heavy activity) |
| May 11 | 174.196.15.165 | Different network |
| May 12 | **76.36.192.99** | Home WiFi (event downloads) |

**76.36.192.99** appears to be the home WiFi IP (Spectrum/Charter footprint). Its presence across all dates confirms the phone was never seized — Matthew was never incarcerated and had continuous access to his device.

## Legal Significance

1. **Phone was never seized**: The same device with the same hardware ID was actively using the Ring app from the home WiFi throughout the entire period. Matthew was never incarcerated and voluntarily turned himself in to the magistrate on May 11 — his phone remained in his possession.

2. **April 28 scrubbing session**: Systematic timeline review on April 28 (7-8 PM) — Matthew reviewing Ring events from April 14-15, likely in preparation for his legal defense.

3. **May 12 event download**: 12 clips were downloaded to the phone on May 12 (day after turning himself in). These are the 0345xx clips now in all-clips/ — the actual warrant execution footage saved from the Ring app.

4. **Ring account access**: Normal account usage throughout. No evidence of third-party access.

## Limitations

- CSV is malformed (non-standard key:value pairs after initial JSON chunk), making structured analysis of individual events difficult
- IP geolocation not performed — 76.36.x.x is Spectrum/Charter (NC), consistent with Kernersville home
- No data on WHO was using the device — only the device itself is identified