Blaine Mendoza

My name is Blaine Mendoza. I’m 46 years old and I live in Phoenix, Arizona. I

2 suppose I’m a typical computer geek. When I was 10 years old my parents bought me

3 a Commodore 64 the Christmas it first came out. I was hooked. I’ve been a hacker

4 ever since. An ethical hacker, of course. Strictly white hat. When I break into a

5 computer network it’s strictly in order to test and evaluate its security with the intent

6 to make it better, rather than with malicious or criminal intent. The intent makes all

7 the difference in the world. I graduated from Stanford in 1994 with a computer

8 science degree. I interned with Apple every summer, and worked there for a short

9 time after college, but it just didn’t hold my attention. I liked to hack, and a lot of

10 companies were willing to pay a lot of money for someone with that skill.

11 Of course, I did have to get past that misunderstanding with the Air Force. I

12 hacked into their personnel system and showed them how easy it was and what I

13 found. Then I offered to let them hire me to fix it. My idea was that it would be a

14 great way to get a job, but the government saw it differently. I was arrested and

15 charged with a federal felony computer hacking crime. Of course, they couldn’t

16 prosecute me. Like I said, intent is everything, even though the government said that

17 under the statute I was charged with violating, intent wasn’t an element of the

18 offense. In the end we worked it out amicably. I was given a deferred prosecution if I

19 agreed to fix the Air Force system for free. I was a bit put out by that, but I didn’t

20 have much choice. Besides, it would still look good on my resume. The Air Force got

21 a more secure personnel system, and I got all the charges dismissed. They have since

22 hired me for pay on various projects. Oh, and Apple did fire me.

23 The whole thing really turned out to be a golden opportunity. I earned a

24 certification as a Licensed Penetration Tester from the International Council of E-

25 Commerce Consultants, also known as the EC-Council. I started freelancing as a

26 security expert. Companies would hire me to penetrate, or break into, their systems,

27 and then tell them how to make their security better.

28 When mobile smartphones took off, that opened up an entire new opportunity. I

29 added forensic analysis to my skill set. Forensic analysis is basically the practice of

2025 Arizona Mock Trial Case -5-

30 extracting evidence from electronic devices to investigate security breaches or

31 criminal activity. To make sure I had the chops, I earned a Computer Hacking

32 Forensic Investigator certification from the EC-Council, and now I consult as an

33 expert witness with both private enterprise and law enforcement agencies. All the big

34 law enforcement agencies have a budget for a full time analyst and the necessary

35 equipment, which can be quite expensive, so I work for the smaller agencies that

36 can’t afford to keep someone on staff. I have provided training to law enforcement,

37 community college students, and attorneys. I have taught some of the certification

38 courses for the EC-Council certification programs, as well as contributed white

39 papers and articles to the EC-Council. I get paid $150 per hour. I charge for the work

40 on the device, plus any time spent testifying. In criminal cases, I work strictly for the

41 prosecution. I just don’t want to deal with criminals. I’d rather put them in jail than

42 help them go free. I have a 93% success rate in convictions. A good portion of the

43 other 7% is due to prosecutorial incompetence. I’m good at what I do. I’ve testified in

44 approximately 75 cases. This is the first time I’ve testified in Yavapai County. My

45 understanding is that the prosecutor called me because s/he had heard of my

46 reputation. I don’t advertise. I don’t need to. I always get my man, and nothing

47 generates business like a solid reputation.

48 Digital devices like cell phones keep track of everything, and when they are

49 connected to a network all that information is tracked and stored on servers. That

50 network can be wired or wireless, cellular or internet. Anything and everything you

51 do is tracked. Most people are amazed at how little privacy they actually have. They

52 think that using their browser in incognito mode will hide them, but nothing could

53 be further from the truth. VPNs, or virtual private networks, are better, but you have

54 to know how to use them to make them an effective security screen. As soon as you

55 enter any personal information, even an email address, your cover is blown. That’s

56 how the Silk Road guy got caught. He just wasn’t careful enough.

57 To prepare for this case I asked the defendant, Carolyn Armistad, to speak with

58 me, and asked her to voluntarily give me her phone, but she refused. Her lawyer was

59 pretty mad about that. S/he thought I should have gone through him/her. Whatever.

60 Another slimy defense lawyer trying to put some scumbag back on the street.

2025 Arizona Mock Trial Case -6-

61 Anyway, since Armistad wouldn’t talk to me, Officer Wilson had to get a search

62 warrant for Armistad’s phone, which gave him/her the right to search Armistad’s

63 home to find the phone. Rather than let Wilson search her house, Armistad gave the

64 phone to Wilson. Officer Wilson also gave me the phone found on Eagan’s body at

65 the scene. Officer Wilson used a subpoena to obtain Armistad’s and Eagan’s cell

66 phone records from their providers, and cell tower records from the towers in the

67 area. I examined both cell phones, reviewed all the records, and visited the scene of

68 the crime where the murder occurred.

69 According to Officer Wilson’s report, Timothy Eagan’s body was found in the

70 new Silver Hills development in the Hangman Gulch area in Dewey-Humboldt,

71 Arizona. The body had obviously been removed by the time I visited the scene.

72 However, Officer Wilson told me that everything else was just as it had been at the

73 time of the murder, although construction activity had obviously continued and I’m

74 sure some things had been moved around.

75 Officer Wilson sent Armistad’s phone to me via overnight courier. Unfortunately,

76 Officer Wilson was not well versed in the preservation of electronic evidence. The

77 phone was in a regular bubble wrap-lined mailing envelope but turned on and not in

78 airplane mode or in a Faraday bag. A Faraday bag acts as an electronic isolation

79 chamber. Turning a phone off or to airplane mode, as well as putting it in a Faraday

80 bag, ensure that the phone cannot send or receive signals, update software, or reset

81 itself. Any of those things can add or delete valuable data.

82 The first thing I did was to install write-blocking software so that I could view the

83 data on the phone, but nothing could be changed or added. I then used HackerBuddy

84 iOS Forensic software, which is forensic data extraction software that allows me to

85 access the data even if the phone is locked and I don’t know the passcode. It’s

86 important to use the latest version, or almost the latest. HackerBuddy came out with

87 a major upgrade two days before I conducted my examination. I never upgrade right

88 away, though, since there are always bugs that have to be worked out of any major

89 release. I always wait for the first few bug fixes before I upgrade. Anyway, the tool is

90 usually still just as good.

2025 Arizona Mock Trial Case -7-

91 I examined Armistad’s cell phone, starting with the easy stuff - texts, emails,

92 phone calls, and voicemails that could easily be accessed on the device. I found a text

93 message exchange between Armistad and “Val” in which Amistad expresses a desire

94 to kill Eagan. A printout of that conversation is included in the exhibits. I did a

95 phone number trace, and I was able to confirm that the “Val” named as the contact

96 was Val Warren. The time at the top of the phone is the time I examined it, not the

97 time the messages were sent. None of the other text messages revealed anything of

98 interest. There was an unanswered call from Tim Eagan made at 6:20 p.m. on

99 September 1st. Eagan did not leave a message.

100 I did find photos of the construction site on Armistad’s phone. The phone had

101 location services turned on for the camera, which means it used satellite GPS to

102 make a note of where the phone was when the picture was taken. The metadata on

103 the photos indicated that they were taken on September 1, 2024, at 8:05 p.m., which

104 was shortly before the time that Eagan was murdered. The time was well after

105 Armistad arrived at the cul de sac, indicating she was there for far longer than

106 necessary to take these amateurish photos. The photos were taken in quick

107 succession, and all from the same location, as if Armistad was just trying to take

108 pictures to show what she was doing there. As you can see, the photos are low quality

109 and do not show the full extent of the project.

110 Armistad’s phone had complete location data going back for quite some time. It

111 looked like Armistad made no attempt to delete anything. I was only interested in

112 location data on the evening of September 1st, so that was the focus of my

113 investigation.

114 I examined the geolocation data on Armistad’s phone. There are a couple of ways

115 to determine where a phone was at a given time. One is by using the phone’s GPS

116 feature, sometimes called “location services.” On an iPhone you can turn that on or

117 off selectively. For example, you can turn it on for all apps, or only for some apps.

118 You can set whether an app can use GPS all the time, or only when the app is being

119 used. Armistad had location services turned on only when certain apps, such as the

120 camera, were in use.

2025 Arizona Mock Trial Case -8-

121 When location services, or GPS satellite location, are turned off I have to use

122 another method to determine the phone’s location. In this case I used cell tower

123 triangulation to determine the location of Armistad’s phone. I’ll explain what that is:

124 In order to send or receive calls or any other data, the system needs to know where

125 your phone is. Your phone is constantly pinging, or contacting, the cellular system

126 through the nearest cell tower. If you get a phone call, the system will use that tower

127 to send the call to your phone. If more than one tower is in range, I can locate your

128 phone by measuring the time it takes a signal to travel between the towers and your

129 phone. From there I can use high school trigonometry to find your location. Cell

130 tower triangulation is not as accurate as GPS, which relies on satellites that can

131 locate you within a few feet, but it can still provide an acceptable picture of where

132 someone was at a particular time.

133 A third way to determine a phone’s location is through the phone’s Wi-Fi signal.

134 This works even if the phone doesn’t have the password to connect to the router the

135 signal is coming from. Go to your phone’s settings and look at the available Wi-Fi

136 networks. You may not have the passcode to any of them, but the fact that your

137 phone can see them means a signal is being exchanged between the router and your

138 phone. I can triangulate your location by using the signal strength and signal travel

139 time.

140 Armistad had Wi-Fi turned on, which meant that I could use the Wi-Fi signal in

141 conjunction with cell tower triangulation to increase the location accuracy. You can

142 try that yourself to see how it works. If you turn Wi-Fi off and then open your map

143 app, the app will sometimes tell you that it needs you to turn the Wi-Fi on in order to

144 be accurate. When you turn Wi-Fi back on, the map will work, even if you are not

145 connected to the internet. When I visited the scene there were only two weak Wi-Fi

146 signals, as this is a new development, and the occupied homes are some distance

147 from the crime scene.

148 We know from witnesses that Armistad was at the Wicked Spud restaurant at

149 5:30 p.m. According to her phone’s location data she was at the restaurant until 7:20

150 p.m. We know that Armistad sent a text message at 7:44 p.m. saying she was going to

2025 Arizona Mock Trial Case -9-

151 the construction site. We know that Armistad sent another text message at 8:15 p.m.

152 saying that she was “on her way” from the construction site.

153 I visited the site and conducted signal strength tests. This is not the same as

154 looking at the number of bars or dots on the phone, which is completely subjective

155 and varies from carrier to carrier. Real signal strength is measured in decibels, or

156 dBm. It’s a negative number, generally in a range of -50 dBm to -120 dBm. The

157 closer the number is to zero the stronger the signal. Unfortunately, my professional

158 grade signal strength meter was on the fritz at the time I did this investigation, so I

159 had to measure the signal with Armistad’s phone. Armistad’s phone had a signal

160 strength of -80 dbM - 100 dBM throughout the development. The greater the signal

161 strength, the greater the accuracy of the location data. It would have been nice to

162 have a range closer to -50 dBM, but I had to go with what I got. Also, environmental

163 conditions such as weather, or whether the sun was up, will affect signal strength.

164 Unfortunately, I was unable to replicate the exact conditions that existed on

165 September 1.

166 Armistad’s phone is an iPhone 15 with iOS version 17.0, which was released in

167 September 2023. The path shows that Armistad was at the restaurant, then left the

168 restaurant at 7:20 p.m. and went to the real estate office, arriving at 7:23 p.m. The

169 accuracy isn’t enough that I can trace her movements within the office, but it’s likely

170 she was trying to access Eagan’s safe or retrieve her gun, or both.

171 Armistad left the office at 7:40 p.m. The path Armistad traveled once she arrived

172 at the development is marked in red. Armistad parked her car at the spot marked

173 with a “1”. She then walked up toward the house and took pictures from the location

174 marked “2”. She then walked back toward the road, but instead of going directly to

175 her car she went to the spot marked “3”. Before she left, she traveled generally

176 around the area marked “4”. The signal then shows that Armistad moved back to her

177 vehicle and left. The path and time indicate Armistad went directly from the

178 development to Val Warren’s home. She was there for approximately one hour, then

179 she returned to her home.

2025 Arizona Mock Trial Case -10-

180 One thing you will notice is that the path is more of a swath than a fine line.

181 Geolocation by cell tower triangulation always has a margin of error. I was able to

182 determine that the data on Armistad’s phone has a margin of error of +/- 25-75

183 meters, depending on her location. That’s about 82-246 feet, or 27-82 yards. It’s not

184 possible to trace an exact path. However, given the movement we can trace, and the

185 times and places we can pinpoint with GPS, we can get a picture of what happened. I

186 included the applicable margin of error in the path, which is why it is wider at some

187 points and narrower at others.

188 Eagan’s phone was found on his body. Eagan used an iPhone 15 with iOS version

189 17.0, which was the most recent version at the time. Location services, GPS, and Wi-

190 Fi were activated. That means the location data I have for Eagan is very accurate.

191 You can see that the path on the map I’ve drawn for Eagan is a much finer line than

192 what I could draw for Armistad. The location services indicated Eagan arrived at the

193 cul de sac at 7:30 p.m. and followed the path indicated on the map in blue. He

194 parked at the end of the cul de sac, at the spot marked “A”. Eagan then moved along

195 the path indicated until he ended up at the spot marked “B”. That is where Eagan’s

196 body was located. Eagan’s path ended there at 8:10 p.m., which means we can very

197 accurately determine the time of death. It’s important to note that Armistad was still

198 at the scene and in the area where Eagan’s body was found.

199 I also found a text message on Eagan’s phone from earlier on September 1st. I’ve

200 also included a printout of that message as an exhibit. The other party is shown as

201 “Unknown.” A number trace revealed that the call came from a “burner” phone. A

202 burner phone is one that is purchased at a retailer like Wal-Mart or Walgreen’s, often

203 for cash, and doesn’t have a contract attached to it. You typically pay as you go on

204 such phones by buying minutes as you need them. You don’t have to identify yourself

205 to set up the phone, so they can be used anonymously. People sometimes use a

206 burner phone for a limited time or a limited purpose, such as being able to sell

207 products online without using a personal number, or to cover criminal activity.

208 In this case the caller ID was blocked, so I couldn’t get the number from Eagan’s

209 phone. Since I knew the time the message was sent I was able to locate cell tower

210 information that included the unique ID of the phone. I called the number associated

2025 Arizona Mock Trial Case -11-

211 with that ID but it was inactive. I traced the ID to the retail store where the phone

212 was purchased. As I suspected, the phone was purchased for cash. There was no

213 video surveillance, so I could not get a photo of the person who purchased the phone.

214 All I can say is that Eagan received a text message from someone he apparently

215 knew, but who wanted to remain anonymous to anyone looking into the source of the

216 message.

217 Eagan had no photos on his phone that were taken on September 1st.

218 First, Armistad arrived at the scene after Eagan. It would have been impossible

219 for Armistad not to have seen Eagan’s car and known that Eagan was there.

220 Armistad’s text message to Val Warren confirms that she did, in fact, know that

221 Eagan was in the area. The area is also fairly flat, so most of both lots are visible from

222 the road, meaning that it would have been almost impossible for Armistad not to see

223 Eagan or for Eagan not to see Armistad.

224 Second, we know that Armistad was at the construction site between 8:00 p.m.

225 and 8:15 p.m. However, before and after that Armistad was moving around the area

226 of both lots and the murder scene for approximately five minutes. While it's true that

227 Armistad’s phone’s closest geolocation point to the spot where Eagan’s body was

228 found is 35 meters, this is well within the margin of error.

229 Third, after Eagan left the restaurant that night, no one else saw him alive again,

230 with the obvious exception of Armistad.

231 I could not find the “Unknown” number in the cell tower data during the time

232 that Eagan was at the construction site. That does not mean whoever used that

233 number was not there. It just means I have no way to verify whether they were or

234 not. So while I can’t say that no one else was in the area at the time, I can say that

235 Armistad definitely was.

236 I was not given any other phones or phone numbers to track. My understanding

237 is that Officer Wilson did not have any additional cell phone evidence. Without

238 additional device information I can’t determine who else may or may not have been

239 in that area at the time of the murder. While it is possible to determine that from cell

2025 Arizona Mock Trial Case -12-

240 tower records, you need to have something to look for. Cell towers receive hundreds

241 and thousands of pings over any given time period. Without knowing what data to

242 isolate it would be like looking for a needle in a haystack.

243 Put all this together and the evidence is conclusive that Armistad shot and killed

244 Eagan.