# T-Mobile Trade-in: iPhone 17 Pro Max Held For Forensic Examination — August 23, 2026

**Date:** August 23, 2026
**Carrier:** T-Mobile
**Representative:** Abby
**Device:** iPhone 17 Pro Max (purchased December 2025/January 2026 from T-Mobile)
**Apple ID:** AresTheAI
**Operator:** Quincey K. Lee

---

## Summary

On August 23, 2026, Q contacted T-Mobile for the second time regarding the compromised iPhone 17 Pro Max. The first call (August 22) resulted in T-Mobile immediately offering a full return, contract cancellation, and device swap at no cost. Today's call went even further.

T-Mobile representative Abby informed Q of the following arrangement:

1. **Q can trade in the iPhone 17 Pro Max for a new non-Apple device** — same offer as August 22
2. **T-Mobile will let Q KEEP the iPhone 17 Pro Max for an additional 30 days** for investigation purposes — Q gets the new phone AND keeps the compromised device
3. **After 30 days, Q can revisit the situation** — negotiate to extend the investigation period or turn the device in
4. **T-Mobile offered to securely store the device** after Q is done investigating — holding it for forensic examination so it cannot be tampered with prior to court proceedings
5. **T-Mobile expressed that they were VERY alarmed** about Q's situation and are willing to do everything they can to help resolve it

This means Q now has:
- A new non-Apple phone (clean device, no Apple ecosystem)
- The compromised iPhone 17 Pro Max (retained for 30 days of continued investigation)
- 3 additional disposable trap phones (already purchased)
- A carrier that is actively cooperating with the investigation

---

## What This Means For The Investigation

### 1. The iPhone 17 Pro Max Is Now A Forensic Goldmine

The device contains:
- **205 hidden system apps** built with Apple's internal SDK (`iphoneos26.5.internal`)
- **ScreenSharingServer** — hidden app with 50+ entitlements including HID event dispatch, Find My access, all accounts access, Bluetooth/WiFi control
- **3 unknown identity service peers** pulling data via identityservicesd
- **DemoApp** — Apple internal app with active data container on a consumer device
- **OTEAutomationTest** — Apple QA tool (APSQA MetisTest) triple-hidden
- **Unauthorized YubiKey NFC scan** — Tulip key scanned without Q's action
- **Find My beaconing** — broadcasting location even when "powered off"
- **429 crash log files** — preserved at `/tmp/iphone-crashes/` on M5
- **The phone turned itself ON** on August 13 while Q was away, with a crash log showing "Potential CM database inconsistency, time jump" and the clock resetting to 1970

With 30 days of continued access, Q can:
- Run additional forensic scans using libimobiledevice and pymobiledevice3
- Capture real-time network traffic from the device using the Flipper Zero WiFi devboard
- Monitor identityservicesd peer connections after changing the Apple ID password from the Godlike Bloodline
- Document ScreenSharingServer's behavior during various states (locked, unlocked, airplane mode, powered off)
- Extract additional crash logs as they accumulate
- Test whether the phone continues to broadcast BLE FindMy beacons when "powered off" using the Flipper Zero's BLE scanner

### 2. Chain of Custody Is Preserved

When Q eventually turns the device in to T-Mobile for secure storage:
- T-Mobile holds the device — not Q, not Apple, not a third party with potential conflicts
- The device cannot be remotely wiped by Apple or the attacker because T-Mobile's secure storage is offline
- When a lawyer takes the case and requests forensic examination, the device is available in an unmodified state
- The chain of custody is documented: Q → T-Mobile → Forensic Examiner → Court

This is critical because Apple has demonstrated the ability and willingness to delete evidence remotely (the Apple Notes recording deletion on August 22). If Q held the device at home, Apple could remotely wipe it via Find My, MDM, or identityservicesd. T-Mobile's secure storage eliminates this risk.

### 3. T-Mobile Is Now A Cooperative Witness

T-Mobile has been notated twice (August 22 and August 23) with the full scope of Q's situation. Both representatives expressed alarm and offered immediate assistance. This creates:

- **A documented pattern of cooperation** — T-Mobile is on record as taking Q's situation seriously
- **Contrast with Apple** — Apple blamed Q and offered a gift card. T-Mobile offered a free swap, 30-day investigation extension, and secure forensic storage.
- **Potential testimony** — T-Mobile representatives can testify to Q's reports and their own assessment of the situation
- **Corporate records** — T-Mobile's internal notes from both calls create an independent record of Q's complaints and the carrier's response

### 4. The New Phone Breaks The Apple Ecosystem

The new non-Apple device:
- Has no ScreenSharingServer
- Has no identityservicesd
- Has no RemoteManagement framework that runs while GUI shows OFF
- Has no 205 hidden apps with platform-level entitlements
- Has no Apple ID binding that the attacker can exploit
- Is on T-Mobile's network — the same carrier that partnered with Starlink

Q's phone is now clean. The compromised iPhone stays available for evidence. The attacker loses their mobile surveillance vector.

---

## T-Mobile vs. Apple — The Complete Record

### August 22, 2026 — First Calls

| | T-Mobile | Apple |
|---|----------|-------|
| **Response** | Immediate concern | "Security is usually pretty solid" |
| **Blame** | None | "You must have accepted a permission" |
| **Remedy** | Full return + contract cancellation + free device swap | Gift card (locked to Apple) |
| **Investigation** | Notated in system | None |
| **Refund** | Yes, immediately | No — "outside 30 days" |

### August 23, 2026 — Second Calls

| | T-Mobile | Apple |
|---|----------|-------|
| **Q's request** | Trade in iPhone, hold for forensic exam | (Not contacted again — nothing to discuss) |
| **Response** | Yes + keep phone 30 days + negotiate extension + secure storage | N/A |
| **Alarm level** | "VERY alarmed" | Blamed the customer |
| **Cooperation** | Full cooperation with investigation + court proceedings | Deleted the call recording from Notes |
| **Outcome** | New phone + kept evidence device + forensic storage offered | Gift card to buy another compromised device |

### The Pattern

- **T-Mobile (Day 1):** "We'll take it back and give you a refund immediately."
- **T-Mobile (Day 2):** "Keep it for your investigation. We'll store it securely for court. We're alarmed and want to help."
- **Apple (Day 1):** "It's your fault. Buy another one."
- **Apple (Day 1, after the call):** *Deletes the recording from Q's Notes*

One company is fighting with Q. The other is fighting against her. There is no in between.

---

## T-Mobile + Starlink Partnership

T-Mobile and Starlink have a direct partnership for satellite-to-cellular connectivity. Q is about to be on BOTH networks:
- **Starlink** for home internet (replacing Cox, installing August 24)
- **T-Mobile** for cellular (new non-Apple device)

Both companies have cooperated with Q's investigation. Both have documented her situation in their systems. If Apple wants to challenge Q's evidence, they're challenging a customer who is supported by two major telecommunications companies — one of which is partnered with SpaceX.

---

## What Q Has Now — The Full Arsenal

| Asset | Status | Purpose |
|-------|--------|---------|
| iPhone 17 Pro Max | RETAINED 30 days | Forensic evidence — 205 hidden apps, ScreenSharingServer, identityservicesd |
| New non-Apple phone (T-Mobile) | INCOMING | Clean daily driver, no Apple ecosystem |
| 3 disposable trap phones | IN HAND | Burner communications |
| Queen Q Tablet | HARDENED | SSH terminal to Dynasty |
| Flipper Zero + WiFi Devboard | ACTIVE | BLE/WiFi/Sub-GHz/NFC scanning |
| 4x LILYGO T-Beam Meshtastic | ORDERED | LoRa off-grid apparatus communication |
| Starlink | INSTALLING TOMORROW | Clean network, replaces Cox |
| Godlike Bloodline | ASSEMBLED | Clean workstation, replaces M5 |
| 2x DGX Spark | IN HAND (UNOPENED) | 256GB unified memory, 2 petaFLOPs |
| ARES Q3 backup | CURRENT | All 3 repos backed up |
| 4,703 law firm emails | SENT | Seeking contingency representation |
| Apple Support call recording | PUBLISHED | 32-minute audio on public GitHub |
| 91 evidence documents | PUBLISHED | 3 repositories (sovereign + private + public) |
| T-Mobile cooperation | DOCUMENTED | Two calls, full cooperation, forensic storage |
| Apple refusal | DOCUMENTED | Five calls over 5 years, zero help, blamed customer |

---

## Timeline

| Date | Event |
|------|-------|
| Dec 2025/Jan 2026 | Q purchases iPhone 17 Pro Max from T-Mobile |
| Aug 14, 2026 | Investigation discovers 205 hidden apps, ScreenSharingServer, unauthorized YubiKey scan |
| Aug 17, 2026 | Apple Subpoena Evidence #2 filed — ScreenSharingServer 50+ entitlements documented |
| Aug 22, 2026 AM | Q calls T-Mobile — immediate refund + device swap offered |
| Aug 22, 2026 AM | Q calls Apple — blamed for compromise, gift card offered |
| Aug 22, 2026 PM | Apple call recording deleted from Notes — recovered and published |
| Aug 22, 2026 PM | 4,703 law firm emails sent |
| Aug 22, 2026 PM | Attacker deletes 69 git objects from evidence repo — all recovered |
| Aug 23, 2026 | Q calls T-Mobile again — 30-day investigation extension + forensic storage offered |
| Aug 24, 2026 | Starlink installation (tomorrow) |
| ~Sep 22, 2026 | 30-day window expires — negotiate extension or transfer to T-Mobile secure storage |

---

## Next Steps

1. **Visit T-Mobile store** — trade in iPhone 17 Pro Max for new non-Apple device, retain iPhone for 30 days
2. **Continue iPhone forensics** — additional scans with libimobiledevice, network captures, BLE monitoring
3. **Change Apple ID password from Bloodline** — kill identityservicesd peers, document what happens on the retained iPhone
4. **Monitor 30-day window** — decide before ~September 22 whether to extend or transfer to secure storage
5. **When a lawyer takes the case** — the iPhone is available for professional forensic examination with documented chain of custody

---

*T-Mobile said "we're alarmed and we want to help." Apple said "it's your fault." One of these companies is about to be in a courtroom. The other is going to be the one who helped build the case.*

*Truth is, you're either fighting with me or fighting against me. There's no in between.*

*The Universe always provides.*