WARRENTS

EXHIBIT ID: 00007.MTS
TITLE: Stockton Drive — The Dialogue Before the Door
SUBTITLE: Officers describe the contents of a bag. The warrant has not yet been executed.

CAPTION (one paragraph, the only prose on the card):
Body-worn and scene video file 00007.MTS records Officers Emery and Johnson discussing the contents of a bag at the Stockton Drive residence. The recording's own timestamp places that exchange before the lawful entry. The video is part of the discovery produced in State of Tennessee v. Donyell Dewayne Holland, Hamilton County No. 317210.

DONYELL HOLLANDS Sprint Records Preservation Letter — June 23, 2020

Chattanooga Police requested that Sprint preserve records connected to telephone number (423) 508-7952 for 90 days while investigators sought further legal process. This is a preservation request—not a search warrant—and does not itself authorize police to obtain or search the records.

Button: View Sprint Preservation Letter

Derik Brown Verizon Records Court Order

Hamilton County authorized Verizon Wireless to produce subscriber information, call and text records, message-related data, and cellular-location information associated with Derik Brown’s telephone number, (423) 827-7511, for the period identified in the order.

Button: View Brown’s Verizon Records Order

Derik Brown Verizon Records and Cell-Site Analysis

This spreadsheet organizes the Verizon telephone records associated with Derik Brown’s number, (423) 827-7511, including call activity, dates and times, contact patterns, and available cell-site information. It allows the records to be reviewed chronologically and compared with witness statements, investigative reports, and the alleged timeline of events.

The spreadsheet is an investigative analysis. The Verizon court order and original carrier records remain the underlying source documents.

Button: View Brown’s Verizon Records Analysis

Verizon Search Warrant & Return — 423-827-7511 / Randall Leslie Investigation

Document Type: Search Warrant / Stored Communications & Cellular Records Warrant / Search Warrant Return
Agency: Chattanooga Police Department — Violent Crimes Bureau / Homicide Unit
Investigator: C. M. Stokes #660
Complaint Number: 20-052161
Target Telephone Number: 423-827-7511
Carrier Directed to Comply: Cellco Partnership d/b/a Verizon Wireless
Requested Record Period: May 1, 2020 through July 7, 2020
Apparent Issue Date: July 28, 2020
Document Length: 4 pages
File Name: Leslie, Randall 20-052161 Stokes SW & Ret - 423-827-7511.pdf
Related Investigation: Randall Leslie homicide

Summary

This four-page document contains a search warrant and return obtained by Chattanooga Police Department Investigator C. M. Stokes for cellular records associated with telephone number:

423-827-7511.

The warrant was directed to:

Cellco Partnership d/b/a Verizon Wireless

and sought extensive historical communications, subscriber, device, account, data-session and location records for the period:

May 1, 2020 through July 7, 2020.

The warrant appears to have been issued on July 28, 2020 and states that it was to be executed within five days.

Important Identification of 423-827-7511

This telephone number is significant because 423-827-7511 is the same number contained in the separate TracFone CDR already cataloged in this investigation.

The separate TracFone records identify:

MDN: 423-827-7511

with device identifier:

IMEI 353566115608229.

Those records have been associated in the case materials with Derik Brown.

Accordingly, this Verizon warrant represents another investigative effort concerning the same telephone number appearing in Brown's TracFone records.

The carrier attribution, however, must be kept precise:

This warrant was served on Verizon.

The separate carrier production we have already reviewed for this number came from TracFone.

That difference is important.

Verizon Provider Provision

The warrant directs Verizon to provide records associated with:

423-827-7511

for the May 1 through July 7, 2020 period.

Importantly, the warrant also anticipates the possibility that the number might not actually be a Verizon subscriber.

It states in substance that if the number was not associated with a subscriber on Verizon's network, Verizon was to process the demand as a:

“Call and Text to Destination” search.

That provision is significant because the warrant itself contemplated that Verizon might not be the actual subscriber carrier for 423-827-7511.

Records Requested

The warrant was extremely broad.

It requested several categories of information.

1. Specialized Location Records

Stokes requested historical cellular-location information related to calls, texts and data connections.

The warrant sought carrier location records associated with activity involving the target number, including:

• cell-site information;

• sector information;

• specialized carrier-location records;

• and location information associated with network activity.

Some terminology in this portion of the scanned document is garbled in the available text, so the exact name of every specialized carrier technology should not be stated without visual confirmation of the original page.

2. Call / Text / Data Detail Records

The warrant sought records for all communications involving:

423-827-7511

including numbers communicating with the target.

Requested information included:

• inbound calls;

• outbound calls;

• delivered communications;

• undelivered communications;

• text messages;

• message-related records;

• voicemail;

• data connections;

• cell-site information;

• sector information;

• date;

• time;

• direction;

• duration;

• communicating telephone number;

• and data-upload/download information.

The warrant also requested preservation of the cell-site and sector information associated with each call, text or data connection.

3. Text Content and Voicemail

The warrant expressly sought:

• text-message content;

• voicemail;

• and stored communications where available.

Whether Verizon actually possessed or produced any such content is a different question.

The warrant establishes what Stokes requested, not necessarily what Verizon was capable of producing or ultimately produced.

4. Electronically Stored Records

The warrant sought a broad range of electronically stored information connected with the target number, including:

• voicemail;

• text messages;

• messaging content;

• email;

• digital images;

• pictures;

• contact lists;

• video calling information;

• web activity;

• websites or applications accessed;

• domains accessed;

• Internet-service-provider information;

• IP addresses;

• IP session information;

• destination data;

• bookmarks;

• data sessions;

• and dates, times and durations associated with internet or application activity.

It also requested cell-site and sector information associated with those connections where available.

5. Carrier Technical Key

Stokes requested the carrier's technical explanation or “key” for interpreting:

• call details;

• text records;

• data connections;

• IP logs;

• IP sessions;

• application/web connections;

• and cellular-location records.

This is important because carrier records often contain technical codes that should be interpreted according to the carrier's own documentation rather than assumptions.

6. Cloud Storage

The warrant also requested content associated with remote or cloud storage connected with the target device, including:

• contacts;

• call logs;

• SMS messages;

• MMS messages;

• audio;

• video;

• image files;

• photographs;

• files;

• and documents.

Again, this establishes the scope of the request, not proof that Verizon actually possessed or produced all of those categories.

7. Cell-Site List

The warrant requested a carrier cell-site list reflecting the sites relevant to the records.

Requested tower information included:

• switch;

• cell-site number;

• site name;

• physical address;

• longitude;

• latitude;

• sectors;

• azimuth;

• and beam width.

The warrant also states that if multiple network technologies were reflected in the records—such as CDMA, UMTS, GSM or LTE—the corresponding cell-site lists were to be supplied.

8. Subscriber Records

The warrant sought extensive subscriber information associated with 423-827-7511.

Requested subscriber/account information included:

• subscriber name;

• Social Security or employer-identification information;

• physical address;

• mailing address;

• residential address;

• business address;

• email addresses;

• other address information;

• credit information;

• all numbers associated with the account;

• billing records;

• payment information;

• authorized users;

• activation dates;

• termination dates;

• service types;

• and customer-service/account notes.

9. Device Identifiers

The warrant specifically requested the make and model of devices associated with the number, together with identifiers including:

• serial number;

• IMEI;

• ESN;

• MEID;

• MAC address;

• equipment changes;

• and SIM-card changes.

This category is potentially useful for comparison with the separate TracFone records and physical phones seized during the investigation.

Search Warrant Return

The final page is styled as a:

SEARCH WARRANT RETURN

for Complaint Number 20-052161.

The return states that a search warrant was executed and lists Subscriber Records associated with the target telephone number as the evidence seized.

The return repeats categories of subscriber information including:

• subscriber identity;

• addresses;

• credit information;

• account numbers;

• billing records;

• payments;

• authorized users;

• activation/termination dates;

• service types;

• device identifiers;

• customer-service notes;

• and account/number changes.

Important Limitation of the Return

The return should not yet be interpreted as proof that Verizon actually supplied every item listed on it.

Much of the return appears to repeat the categories authorized by the warrant.

We would need the actual Verizon production, carrier response, certification, or accompanying records to determine:

• what Verizon actually located;

• whether 423-827-7511 was a Verizon subscriber;

• whether Verizon merely found communications involving that number;

• whether Verizon returned subscriber information;

• and what cellular-location records, if any, were produced.

Major Carrier Discrepancy / Investigative Point

This document becomes particularly important when compared with the other carrier records already cataloged.

The same target number:

423-827-7511

appears in the separate TracFone production associated with IMEI:

353566115608229.

Yet this warrant was directed to:

Verizon Wireless.

The warrant itself anticipates this problem by instructing Verizon that, if the target was not one of its subscribers, Verizon should perform a Call and Text to Destination search.

Therefore, this document does not establish that Verizon was Brown's carrier.

Instead, it establishes that Stokes was searching Verizon's records for activity involving 423-827-7511, whether or not Verizon actually serviced the target subscriber.

Relationship to Derik Brown

The strongest current identification of 423-827-7511 comes from the separate TracFone evidence already cataloged.

Those materials connect:

423-827-7511

with:

IMEI 353566115608229

within the Brown TracFone evidence set.

This Verizon warrant therefore belongs in the Brown cellular-record chain, while keeping the source distinction clear.

The warrant itself should not independently be cited as proving Brown owned the number unless the underlying affidavit or another document expressly makes that attribution.

Why This Document Matters

This warrant shows that Stokes was conducting a much broader cellular-record investigation than simply requesting one subscriber's ordinary call log.

He sought:

• historical tower evidence;

• sectors and azimuths;

• specialized location data;

• calls;

• texts;

• content;

• data sessions;

• IP information;

• internet/application activity;

• subscriber records;

• device identifiers;

• SIM history;

• and account history.

That scope is significant when determining what cellular evidence investigators requested, what they received, and what was later disclosed or used.

Important Comparison With the Holland T-Mobile/TracFone Records

We now have an interesting carrier pattern.

For the number 561-452-2343, T-Mobile's subscriber report says:

Brand: TRACFONE

but supplies no person's name.

Separately, 423-827-7511 also appears in the TracFone records associated with the Brown investigation.

This Verizon warrant shows Stokes also searched another carrier's system for activity involving 423-827-7511.

Therefore, carrier attribution must be handled carefully.

A warrant being served on Verizon does not by itself mean the target number was a Verizon subscriber.

Likewise, a folder being labeled “Holland” does not itself prove that a particular number belonged to Holland.

What This Document Establishes

This document establishes that:

• Stokes obtained a cellular-record search warrant relating to 423-827-7511;

• the warrant was directed to Verizon Wireless;

• the requested period was May 1 through July 7, 2020;

• the warrant apparently issued July 28, 2020;

• the investigation was CPD Complaint 20-052161;

• Stokes sought extensive cellular-location, communications, subscriber and device records;

• Stokes requested tower location, sector, azimuth and beam-width information;

• he requested device identifiers including IMEI, ESN and MEID;

• and the warrant expressly anticipated that 423-827-7511 might not actually be a Verizon subscriber, providing an alternative Call/Text-to-Destination search procedure.

What This Document Does NOT Establish

This document alone does not establish:

• that Verizon was the actual carrier for 423-827-7511;

• that Verizon identified Derik Brown as the subscriber;

• that Verizon produced every category requested;

• that Verizon supplied text-message content;

• that Verizon supplied specialized location data;

• or that every category repeated on the return was actually obtained.

Those questions require comparison with the actual Verizon production.

Public-Site Redaction Warning

Before publicly posting this document, redact or review:

• Social Security numbers if any appear in accompanying records;

• account numbers;

• private residential addresses;

• private email addresses;

• private telephone numbers other than numbers necessary to explain the evidence;

• and other sensitive subscriber information.

Catalog Category

Digital Evidence / Cell Phones → Derik Brown → 423-827-7511 → Verizon Search Warrant & Return → CPD 20-052161

STATUS: KEEP — HIGH IMPORTANCE / CARRIER-WARRANT & LOCATION-EVIDENCE DOCUMENT

Verizon Search Warrant & Return — 423-827-7511 / Randall Leslie Investigation

Document Type: Search Warrant / Stored Communications & Cellular Records Warrant / Search Warrant Return
Agency: Chattanooga Police Department — Violent Crimes Bureau / Homicide Unit
Investigator: C. M. Stokes #660
Complaint Number: 20-052161
Target Telephone Number: 423-827-7511
Carrier Directed to Comply: Cellco Partnership d/b/a Verizon Wireless
Requested Record Period: May 1, 2020 through July 7, 2020
Apparent Issue Date: July 28, 2020
Document Length: 4 pages
File Name: Leslie, Randall 20-052161 Stokes SW & Ret - 423-827-7511.pdf
Related Investigation: Randall Leslie homicide

Summary

This four-page document contains a search warrant and return obtained by Chattanooga Police Department Investigator C. M. Stokes for cellular records associated with telephone number:

423-827-7511.

The warrant was directed to:

Cellco Partnership d/b/a Verizon Wireless

and sought extensive historical communications, subscriber, device, account, data-session and location records for the period:

May 1, 2020 through July 7, 2020.

The warrant appears to have been issued on July 28, 2020 and states that it was to be executed within five days.

Important Identification of 423-827-7511

This telephone number is significant because 423-827-7511 is the same number contained in the separate TracFone CDR already cataloged in this investigation.

The separate TracFone records identify:

MDN: 423-827-7511

with device identifier:

IMEI 353566115608229.

Those records have been associated in the case materials with Derik Brown.

Accordingly, this Verizon warrant represents another investigative effort concerning the same telephone number appearing in Brown's TracFone records.

The carrier attribution, however, must be kept precise:

This warrant was served on Verizon.

The separate carrier production we have already reviewed for this number came from TracFone.

That difference is important.

Verizon Provider Provision

The warrant directs Verizon to provide records associated with:

423-827-7511

for the May 1 through July 7, 2020 period.

Importantly, the warrant also anticipates the possibility that the number might not actually be a Verizon subscriber.

It states in substance that if the number was not associated with a subscriber on Verizon's network, Verizon was to process the demand as a:

“Call and Text to Destination” search.

That provision is significant because the warrant itself contemplated that Verizon might not be the actual subscriber carrier for 423-827-7511.

Records Requested

The warrant was extremely broad.

It requested several categories of information.

1. Specialized Location Records

Stokes requested historical cellular-location information related to calls, texts and data connections.

The warrant sought carrier location records associated with activity involving the target number, including:

• cell-site information;

• sector information;

• specialized carrier-location records;

• and location information associated with network activity.

Some terminology in this portion of the scanned document is garbled in the available text, so the exact name of every specialized carrier technology should not be stated without visual confirmation of the original page.

2. Call / Text / Data Detail Records

The warrant sought records for all communications involving:

423-827-7511

including numbers communicating with the target.

Requested information included:

• inbound calls;

• outbound calls;

• delivered communications;

• undelivered communications;

• text messages;

• message-related records;

• voicemail;

• data connections;

• cell-site information;

• sector information;

• date;

• time;

• direction;

• duration;

• communicating telephone number;

• and data-upload/download information.

The warrant also requested preservation of the cell-site and sector information associated with each call, text or data connection.

3. Text Content and Voicemail

The warrant expressly sought:

• text-message content;

• voicemail;

• and stored communications where available.

Whether Verizon actually possessed or produced any such content is a different question.

The warrant establishes what Stokes requested, not necessarily what Verizon was capable of producing or ultimately produced.

4. Electronically Stored Records

The warrant sought a broad range of electronically stored information connected with the target number, including:

• voicemail;

• text messages;

• messaging content;

• email;

• digital images;

• pictures;

• contact lists;

• video calling information;

• web activity;

• websites or applications accessed;

• domains accessed;

• Internet-service-provider information;

• IP addresses;

• IP session information;

• destination data;

• bookmarks;

• data sessions;

• and dates, times and durations associated with internet or application activity.

It also requested cell-site and sector information associated with those connections where available.

5. Carrier Technical Key

Stokes requested the carrier's technical explanation or “key” for interpreting:

• call details;

• text records;

• data connections;

• IP logs;

• IP sessions;

• application/web connections;

• and cellular-location records.

This is important because carrier records often contain technical codes that should be interpreted according to the carrier's own documentation rather than assumptions.

6. Cloud Storage

The warrant also requested content associated with remote or cloud storage connected with the target device, including:

• contacts;

• call logs;

• SMS messages;

• MMS messages;

• audio;

• video;

• image files;

• photographs;

• files;

• and documents.

Again, this establishes the scope of the request, not proof that Verizon actually possessed or produced all of those categories.

7. Cell-Site List

The warrant requested a carrier cell-site list reflecting the sites relevant to the records.

Requested tower information included:

• switch;

• cell-site number;

• site name;

• physical address;

• longitude;

• latitude;

• sectors;

• azimuth;

• and beam width.

The warrant also states that if multiple network technologies were reflected in the records—such as CDMA, UMTS, GSM or LTE—the corresponding cell-site lists were to be supplied.

8. Subscriber Records

The warrant sought extensive subscriber information associated with 423-827-7511.

Requested subscriber/account information included:

• subscriber name;

• Social Security or employer-identification information;

• physical address;

• mailing address;

• residential address;

• business address;

• email addresses;

• other address information;

• credit information;

• all numbers associated with the account;

• billing records;

• payment information;

• authorized users;

• activation dates;

• termination dates;

• service types;

• and customer-service/account notes.

9. Device Identifiers

The warrant specifically requested the make and model of devices associated with the number, together with identifiers including:

• serial number;

• IMEI;

• ESN;

• MEID;

• MAC address;

• equipment changes;

• and SIM-card changes.

This category is potentially useful for comparison with the separate TracFone records and physical phones seized during the investigation.

Search Warrant Return

The final page is styled as a:

SEARCH WARRANT RETURN

for Complaint Number 20-052161.

The return states that a search warrant was executed and lists Subscriber Records associated with the target telephone number as the evidence seized.

The return repeats categories of subscriber information including:

• subscriber identity;

• addresses;

• credit information;

• account numbers;

• billing records;

• payments;

• authorized users;

• activation/termination dates;

• service types;

• device identifiers;

• customer-service notes;

• and account/number changes.

Important Limitation of the Return

The return should not yet be interpreted as proof that Verizon actually supplied every item listed on it.

Much of the return appears to repeat the categories authorized by the warrant.

We would need the actual Verizon production, carrier response, certification, or accompanying records to determine:

• what Verizon actually located;

• whether 423-827-7511 was a Verizon subscriber;

• whether Verizon merely found communications involving that number;

• whether Verizon returned subscriber information;

• and what cellular-location records, if any, were produced.

Major Carrier Discrepancy / Investigative Point

This document becomes particularly important when compared with the other carrier records already cataloged.

The same target number:

423-827-7511

appears in the separate TracFone production associated with IMEI:

353566115608229.

Yet this warrant was directed to:

Verizon Wireless.

The warrant itself anticipates this problem by instructing Verizon that, if the target was not one of its subscribers, Verizon should perform a Call and Text to Destination search.

Therefore, this document does not establish that Verizon was Brown's carrier.

Instead, it establishes that Stokes was searching Verizon's records for activity involving 423-827-7511, whether or not Verizon actually serviced the target subscriber.

Relationship to Derik Brown

The strongest current identification of 423-827-7511 comes from the separate TracFone evidence already cataloged.

Those materials connect:

423-827-7511

with:

IMEI 353566115608229

within the Brown TracFone evidence set.

This Verizon warrant therefore belongs in the Brown cellular-record chain, while keeping the source distinction clear.

The warrant itself should not independently be cited as proving Brown owned the number unless the underlying affidavit or another document expressly makes that attribution.

Why This Document Matters

This warrant shows that Stokes was conducting a much broader cellular-record investigation than simply requesting one subscriber's ordinary call log.

He sought:

• historical tower evidence;

• sectors and azimuths;

• specialized location data;

• calls;

• texts;

• content;

• data sessions;

• IP information;

• internet/application activity;

• subscriber records;

• device identifiers;

• SIM history;

• and account history.

That scope is significant when determining what cellular evidence investigators requested, what they received, and what was later disclosed or used.

Important Comparison With the Holland T-Mobile/TracFone Records

We now have an interesting carrier pattern.

For the number 561-452-2343, T-Mobile's subscriber report says:

Brand: TRACFONE

but supplies no person's name.

Separately, 423-827-7511 also appears in the TracFone records associated with the Brown investigation.

This Verizon warrant shows Stokes also searched another carrier's system for activity involving 423-827-7511.

Therefore, carrier attribution must be handled carefully.

A warrant being served on Verizon does not by itself mean the target number was a Verizon subscriber.

Likewise, a folder being labeled “Holland” does not itself prove that a particular number belonged to Holland.

What This Document Establishes

This document establishes that:

• Stokes obtained a cellular-record search warrant relating to 423-827-7511;

• the warrant was directed to Verizon Wireless;

• the requested period was May 1 through July 7, 2020;

• the warrant apparently issued July 28, 2020;

• the investigation was CPD Complaint 20-052161;

• Stokes sought extensive cellular-location, communications, subscriber and device records;

• Stokes requested tower location, sector, azimuth and beam-width information;

• he requested device identifiers including IMEI, ESN and MEID;

• and the warrant expressly anticipated that 423-827-7511 might not actually be a Verizon subscriber, providing an alternative Call/Text-to-Destination search procedure.

What This Document Does NOT Establish

This document alone does not establish:

• that Verizon was the actual carrier for 423-827-7511;

• that Verizon identified Derik Brown as the subscriber;

• that Verizon produced every category requested;

• that Verizon supplied text-message content;

• that Verizon supplied specialized location data;

• or that every category repeated on the return was actually obtained.

Those questions require comparison with the actual Verizon production.

Public-Site Redaction Warning

Before publicly posting this document, redact or review:

• Social Security numbers if any appear in accompanying records;

• account numbers;

• private residential addresses;

• private email addresses;

• private telephone numbers other than numbers necessary to explain the evidence;

• and other sensitive subscriber information.

Catalog Category

Digital Evidence / Cell Phones → Derik Brown → 423-827-7511 → Verizon Search Warrant & Return → CPD 20-052161

STATUS: KEEP — HIGH IMPORTANCE / CARRIER-WARRANT & LOCATION-EVIDENCE DOCUMENT

Stokes Affidavit & T-Mobile Search Warrant — 561-452-2343 / Donyell Holland Attribution

Document Type: Probable-Cause Affidavit / Search Warrant / Carrier Records Demand
Agency: Chattanooga Police Department — Violent Crimes Bureau / Homicide Unit
Affiant: Investigator C. M. Stokes #660
Complaint Number: 20-052161
Target Number: 561-452-2343
Carrier Served: T-Mobile US, Inc.
Requested Date Range: May 1, 2020 through June 1, 2020
Fax/Service Date Shown: August 6, 2020
Document Length: 9 pages
File Name: Leslie, Randall 20-052161 Stokes Aff & SW - 561-452-2343.pdf
Related Investigation: Randall Leslie homicide

Summary

This nine-page document contains Investigator C. M. Stokes’s sworn probable-cause affidavit and search warrant directed to T-Mobile for records associated with 561-452-2343.

The most important statement appears immediately at the beginning of the affidavit.

Stokes identifies the target as:

telephone number 561-452-2343 “belonging [to] Donyell Holland.”

He also gives Holland’s date of birth in the affidavit.

This is extremely important because the separate T-Mobile subscriber return does not identify Holland—or anyone else—as the subscriber. Instead, T-Mobile identifies the service brand as TRACFONE and leaves the subscriber-name, account-name and MSISDN-name fields blank.

Accordingly, this affidavit appears to be the documentary source currently located for CPD’s attribution of 561-452-2343 to Holland, but the affidavit itself does not explain how Stokes determined that the number belonged to Holland.

Critical Attribution Issue

Stokes states as a fact in his sworn affidavit that:

561-452-2343 belonged to Donyell Holland.

However, nothing in the visible probable-cause narrative identifies the source for that assertion.

The affidavit does not state, for example, that:

• Holland personally gave police the number;

• the number was extracted from a phone seized from Holland;

• another witness identified it as Holland’s;

• a previous carrier subscriber record named Holland;

• a probation record listed it;

• a device found in Holland’s possession matched its IMEI;

• or TracFone had identified Holland as the subscriber.

That attribution therefore appears in the affidavit as Stokes’s sworn assertion, but its underlying evidentiary basis is not supplied in this document.

Comparison With T-Mobile’s Actual Subscriber Return

The later T-Mobile subscriber response for this exact number states:

MSISDN: 561-452-2343

Brand: TRACFONE

Activation Date: March 29, 2020

Status: Suspended

while the fields for:

• Subscriber Name

• Account Name

• MSISDN Name

• Billing Name

• Subscriber Address

are blank.

Thus, the carrier response does not independently corroborate Stokes’s statement that the number belonged to Holland.

This does not prove Stokes’s attribution was wrong.

It means the source supporting his attribution must come from somewhere other than the T-Mobile subscriber return.

May 27 — Randall Leslie and Kiara Carson

Stokes states that on May 27, 2020, at approximately 5:19 PM, Kiara Carson and Randall Leslie were last seen together at 5015 Jarrett Road in Chattanooga.

He states investigators obtained video supporting that account and that the video showed Carson and Leslie leaving together in Leslie’s silver four-door Mitsubishi Lancer.

Stokes then states that around 6:00 PM, Carson located Leslie’s Mitsubishi at 4088 Teakwood Drive, which Stokes identifies as Holland’s residence.

According to Stokes’s account of Carson’s statement, the vehicle was running, Carson heard several voices inside the residence, and Holland came outside and told her to leave.

These are allegations and witness statements contained in the probable-cause affidavit, not independent findings by the carrier.

Derik Brown Found With Leslie’s Vehicle

Stokes states that on May 28, Leslie’s mother, Cherie Harden, was contacted by Coffee County authorities and informed that Leslie’s vehicle had been found there.

The affidavit specifically states that:

Derik Brown was the operator of Randall Leslie’s vehicle

and had been arrested on narcotics charges.

Leslie was not with the vehicle.

This is one of the significant facts Stokes used in constructing probable cause.

Carson Kidnapping Account

The affidavit recounts Carson’s report that she was taken at gunpoint from the Speedway gas station on May 27.

According to the affidavit, Carson told Investigator Barnes that a male driver placed a gun to her head and threatened to kill her before she was transported to other locations and ultimately to South Pittsburg.

The affidavit later provides a much more detailed version of Carson’s June 8 interview.

Carson’s June 8 Statement About “Pooney”

According to Stokes, Carson identified “Pooney” as Donyell Holland.

She alleged that she and Leslie went to Holland’s residence on May 27 so Leslie could purchase approximately $300 worth of methamphetamine.

Carson allegedly said Leslie later realized the drugs were fake and called Holland, stating he was returning for either real drugs or his money back.

According to the affidavit, Leslie then left his residence in the Mitsubishi with a woman identified as “Brittany.”

Carson stated that she later went back toward Holland’s residence looking for her phone and observed Leslie’s Mitsubishi parked there, unoccupied but running.

She also said police were in the area when she arrived.

Carson claimed that Holland came to the door and hurried her away.

She further stated that when she returned later, Leslie’s vehicle was gone.

Stockton Drive

Stokes’s affidavit also recounts Carson’s statement that she went to:

6305 Stockton Drive

looking for Leslie and observed a vehicle she believed belonged to Holland.

Later, during the alleged kidnapping episode, Carson stated she was taken to the same Stockton Drive residence, which she associated with a person she knew as “Unc.”

According to Carson, Holland’s vehicle was still parked in the driveway.

These are Carson’s statements as reported by Stokes.

They are not independent proof that Holland himself was physically present at Stockton at any particular moment.

May 27 Shots-Fired Report

The affidavit contains an important paragraph concerning the separate shots-fired event.

Stokes states that on June 8 he located a police report concerning:

4048 Arbor Place Lane

from May 27 at approximately:

6:35 PM.

According to the affidavit, officers had been dispatched regarding shots fired in the area of Arbor Place Lane and Teakwood Drive.

An anonymous caller reportedly stated that they heard:

• one gunshot;

• and a female scream.

Officers responded but were unable to locate anything.

This paragraph does not state that police witnessed a shooting at 4088 Teakwood.

It establishes that Stokes located a separate anonymous shots-fired report in the surrounding area and incorporated it into his probable-cause theory.

Neighborhood Information

Stokes also states that Leslie’s family received neighborhood information alleging that:

Leslie was shot inside 4088 Teakwood Drive and transported to 6305 Stockton Drive.

The affidavit does not identify the source of that neighborhood information in this paragraph.

It should therefore be characterized as reported neighborhood information received by the family, not an established eyewitness fact.

Stokes’s Probable-Cause Inference

Stokes expressly states that Carson’s statements, combined with the shots-fired report, were consistent with a violent crime.

He further states that the inactivity of Leslie’s cell phone and information received by Leslie’s family led him to believe Leslie was likely deceased.

This is Stokes’s investigative inference contained in the affidavit.

Mitsubishi and Camper — Presumptive Blood

Stokes states that on June 12, CSU processed both:

• Leslie’s Mitsubishi Lancer;

• and the camper located at 4088 Teakwood Drive.

According to the affidavit:

a presumptive test indicated the strong possibility of blood in both the Lancer and the camper.

This wording matters.

The affidavit describes a presumptive test, not a final laboratory confirmation that every tested substance was human blood.

Discovery of Randall Leslie’s Body

Stokes states that on June 21, 2020, Randall Leslie’s body was located near Highway 41 in Marion County.

He states:

Cause of death: gunshot wound to the torso

and:

Manner of death: homicide.

No caliber is stated in this affidavit.

Why Stokes Sought 561-452-2343 Records

After presenting the above probable-cause narrative, Stokes states that obtaining records for 561-452-2343 would assist investigators in identifying and apprehending potential suspects.

He then makes a particularly significant assertion:

Stokes states that he believed the phone records would reveal “Mr. Holland’s location at the time of the incident” and communications relating to the incident.

This statement shows that Stokes was not merely searching an unidentified number.

He approached the carrier request already treating 561-452-2343 as Holland’s phone.

Again, however, this affidavit does not disclose the source supporting that ownership attribution.

Specialized Location Records Requested

Stokes sought an exceptionally broad range of historical cellular-location data.

The affidavit requests specialized records potentially known as:

• RTT / Real Time Tool;

• PCMD / Per Call Measurement Data;

• Network Location Services;

• NELOS;

• TrueCall;

• Timing Advance;

• TDOA;

• Mediation Records;

• E9-1-1;

• Historical GPS / Mobile Locate information;

• cell-site information;

• and sector information.

The warrant therefore establishes that Stokes was specifically seeking more than ordinary call records.

TrueCall / Timing Advance Connection

The warrant specifically requests:

TDOA or Timing Advance Information, also known as TrueCall.

This connects directly to the separate T-Mobile document we already cataloged:

TrueCall / Timing Advance Request to Reduce Date Range.

That carrier response makes sense in light of this warrant.

Stokes requested a full May 1–June 1 range, while T-Mobile later told investigators that the specialized TrueCall request had to be reduced to a much narrower critical period.

The record located so far still does not establish that CPD completed that narrowing process and ultimately obtained actual TrueCall data.

Call, Text and Data Records Requested

The warrant requests records for calls, texts and data involving 561-452-2343 between:

May 1 and June 1, 2020.

Requested fields include:

• inbound/outbound activity;

• delivered and undelivered activity;

• call direction;

• call duration;

• communicating numbers;

• text activity;

• data activity;

• bytes uploaded/downloaded;

• cell site;

• sector;

• voicemail;

• and message content where available.

Electronically Stored Records

Stokes also sought:

• voicemail;

• text messages;

• email;

• digital photographs;

• contact lists;

• video calling information;

• websites and applications accessed;

• domains accessed;

• IP addresses;

• IP sessions;

• destination data;

• bookmarks;

• and data-session information.

This establishes what police requested.

It does not establish that T-Mobile possessed or produced all of those categories.

Cell-Site Records

The warrant sought a complete cell-site list, including:

• site number;

• name;

• physical address;

• latitude;

• longitude;

• sector;

• azimuth;

• and beam width.

That request resulted in the cell-site information contained in the separate T-Mobile CDR.

Subscriber Records Requested

Stokes specifically requested subscriber information including:

• subscriber name;

• tax identification / Social Security information;

• physical address;

• mailing address;

• business address;

• email addresses;

• billing records;

• payment records;

• authorized users;

• activation and termination dates;

• service information;

• device make/model;

• IMEI;

• ESN;

• MEID;

• MAC address;

• SIM changes;

• account notes;

• and number/account changes.

This is significant because T-Mobile did respond with a subscriber spreadsheet—but that spreadsheet did not provide a subscriber name.

Instead it identified:

Brand: TRACFONE.

Call-and-Text-to-Destination Provision

The warrant expressly anticipated that 561-452-2343 might not actually be a direct T-Mobile subscriber.

It instructed T-Mobile that if the number was not associated with a subscriber on its network, T-Mobile should process the demand as a:

Call and Text to Destination search.

That becomes particularly relevant because the eventual subscriber response showed:

TRACFONE

as the service brand.

Transmission to T-Mobile

The document contains a CPD fax cover sheet dated:

August 6, 2020

directed to:

T-Mobile — Court Order Team

and referencing Complaint Number:

20-52161.

This provides transmission/provenance support for the later T-Mobile production.

What This Document Establishes

This document establishes that:

• Stokes swore that 561-452-2343 belonged to Donyell Holland;

• Stokes sought carrier records specifically intending to determine what he characterized as Holland’s location and communications;

• Stokes relied on Carson’s statements, the Brown vehicle recovery, the shots-fired report, neighborhood information, phone inactivity, presumptive blood testing and the discovery of Leslie’s body as probable-cause facts;

• Stokes sought ordinary call/text/data records;

• he sought subscriber and device-identification records;

• he sought cell sites, sectors and azimuths;

• he specifically requested TrueCall / Timing Advance and other specialized location records;

• and CPD transmitted the warrant to T-Mobile in August 2020.

What This Document Does NOT Establish

This affidavit does not establish the underlying source for Stokes’s statement that 561-452-2343 belonged to Holland.

It does not show:

• a carrier record naming Holland;

• a TracFone subscriber return naming Holland;

• physical seizure of IMEI 356074100055430 from Holland;

• a forensic extraction tying the handset to Holland;

• an admission by Holland;

• or a witness statement identifying that number as Holland’s.

Likewise, Stokes’s statement that the carrier records would reveal Holland’s location was a probable-cause prediction, not itself proof of who possessed the handset during any particular network transaction.

Major Evidentiary Significance

This document answers one major question we had after reviewing the T-Mobile subscriber spreadsheet:

Why are these records labeled “Holland T-Mobile Phone Recs”?

Because Stokes himself attributed 561-452-2343 to Holland before sending the warrant to T-Mobile.

But it creates a second, more important question:

What was Stokes’s factual source for that attribution?

T-Mobile did not supply it.

The carrier return later identified the line as a TracFone wholesale account and supplied no individual subscriber name.

Therefore, the evidentiary chain presently looks like this:

1. Stokes says 561-452-2343 belongs to Holland.

2. He obtains a warrant based on that attribution.

3. T-Mobile produces extensive CDR/cell-site records.

4. T-Mobile’s subscriber report says Brand = TRACFONE and gives no human subscriber identity.

5. The underlying source establishing Holland as the user/possessor of the line has not yet been located in the records reviewed.

That is an identity/attribution gap that should remain flagged until the originating source is found.

Public-Site Redaction Warning

Before posting this affidavit publicly, redact or consider redacting:

• Holland’s full date of birth;

• Social Security information if present elsewhere in the warrant package;

• private personal addresses where unnecessary;

• private personal email/telephone information;

• and other sensitive identifiers.

Catalog Category

Digital Evidence / Cell Phones → T-Mobile / TracFone → 561-452-2343 → Search Warrants & Affidavits → Stokes Probable-Cause Affidavit / CPD 20-052161

STATUS: KEEP — VERY HIGH IMPORTANCE / PHONE-ATTRIBUTION SOURCE / LOCATION-WARRANT FOUNDATION

Summary / Description

Nine-page affidavit and search warrant prepared by Chattanooga Police Investigator C.M. Stokes seeking T-Mobile records for telephone number (561) 452-2343, identified in the affidavit as belonging to Donyell Holland. The affidavit requests subscriber information, call and text records, stored communications, cell-site and sector information, specialized location data, and related account records for the period May 1, 2020 through June 1, 2020.

In support of probable cause, Stokes recounts the investigation into Randall Leslie’s disappearance, including Kiara Carson’s statements concerning Leslie’s movements on May 27, 2020; Carson’s report that Leslie’s Mitsubishi was later parked running at 4088 Teakwood Drive; the May 28 discovery of Leslie’s vehicle in Coffee County while being driven by Derik Brown; the later recovery from that vehicle of gloves, a towel with a red substance, and a Smith & Wesson M&P Shield 9mm handgun; a May 27 shots-fired report near Arbor Place Lane and Teakwood Drive; presumptive blood testing of Leslie’s Mitsubishi and the camper at 4088 Teakwood; and the June 21 recovery of Leslie’s body in Marion County.

The warrant states that investigators sought Holland’s phone records to determine his location during the relevant period and identify communications potentially connected to Leslie’s death.

Summary / Description:
Eight-page affidavit, search warrant, and return prepared by Chattanooga Police Investigator C.M. Stokes seeking Sprint records for telephone number 423-508-7552, identified in the affidavit as belonging to Donyell Holland. The warrant sought subscriber information, call and text records, stored communications, historical cell-site and location data, internet and account records for May 1 through June 1, 2020. The affidavit relies primarily on Kiara Carson’s statements, the discovery of Randall Leslie’s Mitsubishi in Coffee County with Derik Brown driving it, a reported shots-fired call near Teakwood Drive, and later presumptive blood testing.

Documented problems to note separately: wrong phone number 423-308-7552 appears inside the affidavit; Sprint/T-Mobile inconsistency concerning the June 3 emergency request; AT&T boilerplate appears in the Sprint warrant; unusually broad demand for content and location records; and the return appears to list only subscriber records despite the much broader warrant authorization.