# January 5 footage and cell-site materials — source analysis ## Research and reporting acknowledgments Credit **Armitas (@accabbat)** for the independent camera/route research, compilations and annotated maps; **Steve Baker** for publication/reporting; and **Joseph M. (Joe) Hanneman** for related investigative reporting, including the March 23 article jointly bylined with Baker. The Baker/Kyle Seraphin longer breakdown is separately cited. See [CREDITS.md](CREDITS.md) and [credits.json](credits.json) for exact video/stream/article links, archived publication records and per-source roles. Screenshots inherit their source credits; the project's extraction, crops and display do not constitute original footage or original authorship of the underlying research. ## Later source recovery: court filings and map-first display Recovered public RECAP copies of ECF 1-1 (seven-page affidavit), ECF 17 (December 28 detention memorandum) and **ECF 50 (January 23, 39 pages)**. The earlier missing-January-23-filing status below is superseded: ECF 50 pp. 3–7 contain the surveillance/cell chronology and page 7 contains the original map. The complete CAST report, raw session data, timing-advance measurements, historical sector lists and actual drive-test results remain unrecovered. See [court-sources.html](court-sources.html) and acquisition hashes in `analysis/court-filings/manifest.json`. ECF 1-1 pp. 5–6 confirm all seven existing transactions, five IDs/addresses and directions; no changed cell times were found. The map-only display now names the northwest sequence **Brian (attributed)** in blue B1–B7, the hoodie comparison in orange H1–H7, and the user's untimed orange 1–7/Watch sequence separately. Default source-anchor overview includes future points with dashed badges, avoiding the appearance that Brian/cell layers are missing before their times. It does not move a figure to a future anchor. The user-supplied `HJLcU1qXAAADPsy.png` is preserved and shown next to the filed map, with its commentary attributed. Red-circled 1/2 are added hoodie positions, not site labels. Neither the source map nor filings establish the additional claims about absence from every canvassed camera/vehicle list or exact phone use versus session timing. No TA dataset was recovered, which is narrower than a finding that no TA data exists. ECF 1-1 p. 7 and ECF 50 p. 3 report the 19:10 LPR event; neither establishes a vehicle at either device location from that event. New source discrepancy to reconcile: ECF 1-1 p. 7 describes the 19:34 first sighting near North Carolina/New Jersey; ECF 50 p. 3 says First/North Carolina. No exact new point is inserted from this inconsistent description. ## Scope and result This pass acquired and integrity-checked the supplied 15 Rumble-hosted camera exports, visually sampled eight relevant camera windows, and inspected all eight Drive map images, both Drive source-index versions, seven original X post records, and the existing December 4, 2025 complaint. The video downloads total **4,290,289,208 bytes** (about 4.00 GiB); all 15 SHA-256 hashes match the supplied verification manifest. These are hosted renditions, not demonstrated byte-identical USCP evidence exports. Eight two-minute nominal-time camera excerpts (3188 is limited to 86.943317 seconds by its export boundary), anchor stills, and contact sheets are in `clips/` and `stills/`. The footage provides original-source material for testing the published comparison. The cell-site images are explanatory/annotated graphics, not the underlying provider records or a complete CAST report. Neither type of source by itself establishes the identity of the person on the northwest cameras. ## 1. Acquisition and provenance - Supplied package: `/home/maxxiscopolis/Documents/Codex/2026-10-20/use-x20/outputs/`. Preserved under `local-package/`, including filenames, download metadata, Rumble URL manifest, checksums, and downloader. - Google Drive: `gdrive:Armitas-January5-Sources` through the existing `/home/maxxiscopolis/.config/rclone/rclone.conf` remote. - Drive contained **two different files named SOURCE-INDEX.md**. Both were downloaded by their Drive IDs and preserved with size-based suffixes: `SOURCE-INDEX-8303.md` and `SOURCE-INDEX-6179.md`. They describe an earlier source-search state; their statements that originals were not found are now superseded by the separately supplied video manifest. - At retrieval, the Drive `original-videos`, `posts-and-threads`, and `camera-locations-and-clock-notes` directories contained no files. Videos came from the supplied local package. Seven post JSON responses were acquired separately from the FxTwitter API, retaining the original X URLs and text. - `analysis/map-media-provenance.json` records direct X original-media URLs and hash matches to all eight Drive images. The supplied index had only a thread-level attribution for `hoodie-plotted-on-CAST-2026-02-17.png`; the exact reply was recovered: https://x.com/accabbat/status/2023781914612547640 . ## 2. Camera geography and coverage Locations below are **the export names**, supported by the visible scenes. They are street/area labels, not surveyed camera coordinates or tracked subject GPS positions. | Camera | Export location label | Hosted resolution | Relevant presentation label | | --- | --- | --- | --- | | 3192 | 3rd–Pennsylvania NW | 704×480 | 19:57:04 | | 0794 | K9 / New Jersey–D SE | 1920×1080 | 19:57:04 | | 3188 | Peace Circle NW | 704×480 | 19:59:33 | | 3187 | Peace Circle NW | 704×480 | 20:01:16 | | 0600 | NW Drive exit | 1280×720 | 20:01:33 | | 0601 | NW Drive near exit | 1920×1080 | 20:03:18 | | 0602 | NW Drive near New Jersey–Constitution NW | 1920×1080 | 20:04:25 | | 0940 | New Jersey–Constitution NW | 1920×1080 | 20:05:23 | The export names resolve the earlier NW/NE ambiguity for these particular cameras: the route examined here is northwest of the Capitol; 0794 is a separate southeast view. Earlier comments about searching the northeast side do not relocate the recovered northwest camera sequence. Visual review finds the truck scene on 3192, the southeast gate/crosswalk scene on 0794, Peace Circle and crosswalk scenes on 3188/3187, and the NW-drive, wall, barrier, and intersection scenes on 0600/0601/0602/0940. The 3187 contact sheet shows a light-jacketed person crossing; 0601 shows a person beside the wall; 0602 shows pedestrians at the barriers; 0940 shows pedestrians crossing. These support scene matching with the presentation, not an independent identity finding. Small figures and multiple pedestrians require continuous review. ### Clock basis and boundaries No burned-in advancing date/time is visible in the inspected source frames. The excerpts therefore use **filename start time plus media elapsed time**. This is a provisional indexing convention, not independent camera-clock calibration. The published time label may name the beginning of a sequence rather than the instant of its highlighted frame. Inspect the entire padded excerpt rather than expecting its central still to contain the person. The first pair spans nominal **19:56:04–19:58:04 EST** in both camera files. It can be reviewed on a common filename-based clock, but should not yet be described as independently verified second-accurate synchronization. Nominal boundary gaps, computed as next filename start minus previous media end, are: | Camera | Gap between supplied adjacent exports | | --- | --- | | 3192 | 0.585 s | | 0794 | 0.859 s, then 0.043 s | | 3188 | 1.734 s | | 3187 | 0.549 s | | 0602 | 0.443 s | | 0940 | 3.017 s | These may reflect missing frames, export conventions, or encoding duration; they are not proof of missing events. Do not silently concatenate them into a purportedly continuous camera clock. 0600 and 0601 have only one supplied export each. Frame rates vary, including approximately 29.97 and 59.94 fps; equal frame numbers across cameras are not equal wall-clock times. ## 3. Phone transactions: what the complaint actually specifies Source: `research/sources/doj-cole-criminal-complaint-2025-12-04.pdf`, printed pages 5–6. This table reports the government's assertions, not independently obtained provider data. The map's 1–5 labels are display identifiers, not the carrier's numeric site IDs. Sites 2 and 3 share a street address but have different provider IDs and reported directions. | Map label / complaint sector | Provider ID | Address | Reported azimuth | Transactions EST | Idealized ±60° wedge | | --- | --- | --- | --- | --- | --- | | 1 / A | 59323 | 103 G Street SW | 120° | 19:39:27 | 60°–180° | | 2 / B | 126187 | 200 Independence Avenue SW | 90°, disputed historical listing | 19:39:27; 19:44:36 | 30°–150° | | 3 / C | 147990 | 200 Independence Avenue SW | 180° | 19:59:36 | 120°–240° | | 4 / D | 45111 | 101 Independence Avenue SE | 255° | 20:14:36 | 195°–315° | | 5 / E | 144340 | 600 Pennsylvania Avenue SE | 295° | 20:23:59; 20:24:06 | 235°–355° | Seven sector transactions occur at six distinct times, because two occur at 19:39:27. They are described as **data-session transactions**, not necessarily user-initiated calls or texts. The complaint expressly includes background application traffic. ### The 345° versus 90° issue The footnote continuing onto printed page 6 says the February 2021 provider list had sector B at **345°**, and the April list changed it to **90°**. CAST attributes the earlier direction to a listing error, citing January/February 2021 drive-test results and the simultaneous sector-A transaction. That is a **105° shortest-angle difference**, not a minor cartographic rotation. The idealized alternative wedge for 345° would wrap through north: 285°–360° plus 0°–45°. Both historical values should be available as separate layers in a visualization, with the government's explanation attached. The actual lists and drive-test measurements are absent from this package, so we cannot resolve which configuration/coverage applied by inspecting these maps. ## 4. Analysis of all eight Drive images 1. **CAST-map-Cole-vs-Hoodie-2026-01-24.jpg** — annotated prosecution-style map with five site/sector labels, blue/red suspect paths, and two additional numbered suspect-position markers inside a red ellipse. The added markers are *not measured phone positions*. Armitas's post says he added them. 2. **prosecution-map-hoodie-added-2026-04-26.png** — same substantive map and overlay at a smaller image size. Its post claims an alibi, conditional on no contradictory drive test. That conclusion is the author's interpretation. 3. **tower-map-locations-1-2-2026-04-05.png** — **byte-identical** to item 2. Verified against both distinct X original-media URLs; this is genuine reuse across posts, not evidence of a transfer error or another independent map. 4. **CAST-angle-map-2026-09-13.jpg** — another rendering of that annotated map. Again, the visible red-circle markers concern the earlier 19:39/19:44 comparison, not the later 19:57 northwest CCTV pairing. 5. **hoodie-plotted-on-CAST-2026-02-17.png** — smaller/cropped rendering of the same kind of annotated map. Its exact source reply was recovered and hash-matched (post 2023781914612547640); do not count it as independent corroboration merely because it has a different filename/date. 6. **ArcGIS-prosecution-map-2026-02-17.jpg** — annotated version marking an alleged 1° skew and a proposed alternate site-1 location by the Verizon building. The image supports that the author drew those objections; it does not supply surveyed antenna coordinates, GIS projection/rotation metadata, building heights, or RF measurements to validate them. 7. **prosecution-map-detail-2026-04-26.jpg** — despite the filename, this is a **CAST training-slide screenshot**, not a detail of the DC map. It uses a Glen Burnie, Maryland homicide/alibi example and includes added emphasis. 8. **CAST-angle-detail-2026-09-13.jpg** — another image of the same training example, with additional red arrows. It is methodological context, not a case-specific drive test or an independent analysis of Cole's phone. There are **seven distinct byte hashes**, but fewer distinct substantive diagrams. All eight originals are retained; none was deleted as a duplicate. ### What the sector drawings establish—and what they do not The diagrams place some added suspect markers outside the drawn idealized sector wedges. That is a legitimate geometric issue to investigate. It does **not** make the phone's actual location the sector center, nor establish a hard RF exclusion at the drawn boundary. The complaint itself says coverage can be wider or narrower than 120°. The training slide says actual RF coverage can be measured with survey gear/drive tests and describes a drawing rule of thumb rather than a measured coverage contour. Claims about a building blocking service require antenna position/height, frequency, tilt, terrain/building data, propagation/reflection, and preferably contemporaneous survey measurements. A 1° image rotation should be checked with georeferenced map data; it cannot by itself explain a 105° sector-list disagreement. Absence of a recorded session when someone appears to use a phone is not an identification/exclusion test without complete records and an understanding of session logging. ## 5. Where the timelines can actually be compared - **19:39:27–19:44:36:** the annotated maps challenge the phone/hoodie relationship at these times. The northwest video excerpts begin much later; they do not establish who was northwest at 19:39. - **19:57:04:** the published 3192/0794 comparison is now testable against two retained source camera files, with padded nominal-time excerpts. - **19:59:33–19:59:38:** potentially the most useful three-way comparison: 3188 presentation label at 19:59:33, sector-C transaction at 19:59:36, complaint hoodie sighting at New Jersey/E SE at 19:59:38. Need continuous 3188 review and southeast footage of the specific New Jersey/E sighting; 0794 at New Jersey/D is a different view and must not be relabeled as E. - **20:01–20:05:** northwest cameras provide further scene/route comparisons. Connecting the same subject across them requires visual handoff review. - **20:14–20:24:** phone/hoodie assertions extend beyond the highlighted northwest walk. The supplied files do not provide a verified person/vehicle track through all those later phone transactions. The Drive index's claims about vehicle movements and later pings were checked against the recovered X text where possible. The April 5 post indeed asserts the car appears after ping 3; the actual plate-reader/car-identification record is not supplied. The broader later-eastward-motion assertion lacks a specific source post in the Drive index and is not independently established here. ## 6. Presentation plan and concrete remaining records The working review has independent originals, contact sheets, a shared **nominal** clock for the first pair, and the map gallery. For a finished map/video presentation, keep these distinct layers: 1. Camera location/view direction, based on actual camera records or verified street features. A camera's position is not necessarily the subject's. 2. Visually documented subject sightings and handoffs; preserve coverage gaps. 3. Phone transaction instants and attributed site/sector orientations. Draw nominal wedges as diagrams with no fabricated range or GPS track. 4. Raw record versus author annotations, including the alternative sector-B azimuth and the proposed site-1 correction. Needed for stronger findings: the Jan 23 prosecution filing/exhibit and full CAST report; provider session records and historical site/sector lists; January/February drive-test data; surveyed antenna positions/heights and configuration; a timing/calibration record or common-scene camera calibration; and source footage/documents supporting the claimed vehicle identification and later movements. These are specific evidence gaps, not grounds to discard the recovered footage or maps. ## Reproducibility - `overlay.html`: geographic production desk; any camera pair, shared nominal clock, six scenes, coverage intervals, sector variants, attributed events. - `production/README.md`: complete coordinate conventions, asset inventory, SQLite schema/use, source timing, reproducible build and browser checks. - `geography/receipts/`: cached OSM/Census responses; current reference data, not surveyed camera/antenna coordinates. The geocoder's wrong-quadrant Pennsylvania NW result was rejected; exact-address-tagged SE building used. - `build_production.py`, `render_production_preview.py`, `package_production.py`: offline JSON/TSV/GeoJSON/SQLite build, SVG/PNG plates and silent first-pair 1080p proof, portable asset bundle with the eight cuts. - `analyze_sources.py`: verify video hashes/properties; inventory maps; archive post JSON; extract padded source-camera clips and contact sheets. - `archive_map_media.py`: retrieve original X image URLs and hash-match Drive copies. Responses are archived, not used to silently revise the Drive originals. - `analysis/video-inventory.json`, `map-inventory.json`, `clip-manifest.json`, `x-posts-summary.json`, `map-media-provenance.json`: machine-readable receipts. All work is local to the development checkout. No public deployment occurred.