The second installment compiles WSU-received communications and records surrounding the Idaho Four investigation. It opens with January 3, 2023 Moscow releases concerning Kohberger’s extradition, the Idaho court process, and the nondissemination order, then continues with agency correspondence, WSU scheduling and patrol information, Steptoe-related records, public-records handling, and investigative support material. Public releases, internal emails, schedules, and law-enforcement records are different evidence types and are indexed as such rather than treated as one continuous narrative.
The third installment centers on interagency and WSU correspondence. It includes the November 28, 2022 law-enforcement-sensitive vehicle BOLO forwarded by Moscow Police; later messages about Kohberger’s WSU criminal-justice fellowship interview materials; and May 2023 requests for extra patrols around graduate-student housing during renewed media attention and the then-scheduled preliminary hearing. It also contains additional WSU, Pullman Police, Moscow Police, public-information, and administrative records.
The fourth installment compiles WSU safety concerns, institutional communications, media-related correspondence, public-records handling, and investigative support. Visible examples include a parent’s November 22, 2022 questions about campus safety and academic options, a January 2023 message circulating a Kohberger internship-related video, and a January 2024 request concerning memorial coins for WSU Police staff who worked the Idaho Four response. The large production also references parking, LPR, warrant, and administrative records; each thread must be read with its own date and sender context.
The fifth installment continues WSU safety and investigative-coordination records. It includes WSU’s response to community safety concerns, discussion of increased patrols and critical-incident coordination, correspondence about providing campus video to Moscow Police, prosecutor and Washington Attorney General communications concerning WSU records warrants, and other investigative or administrative follow-up extending beyond the immediate arrest period.
The sixth installment contains arrest announcements, agency-response records, warrant and evidence references, vehicle-identification communications, staff messages, and related WSU materials. It opens with the December 30, 2022 Moscow Police arrest release and includes later WSU discussion of how officers located a possible suspect vehicle near Kohberger’s residence. One January 5 message says the public affidavit’s vehicle-discovery timeline was not entirely correct and gives an alternate internal chronology: the BOLO email on November 28, a plate query early November 29, and an observation at the apartment complex shortly afterward. That statement is preserved as the author’s account and should be compared with dispatch, database, and sworn-record timestamps.
The seventh installment is warrant-focused. It includes Whitman County templates and completed application language for searching Kohberger’s Steptoe Village apartment and WSU office, descriptions of the premises, probable-cause material supplied by Idaho investigators, categories of property sought, supporting declarations, and related warrant/inventory records. Because the extraction can flatten checkboxes, signature blocks, exhibits, and inventories, the signed original pages—not this text layer—control the scope actually authorized and the items recorded as seized.
The eighth and largest text installment compiles media requests, interview invitations, press releases, campus-safety communications, public-records correspondence, parking/LPR references, warrant-related material, and institutional messaging. Examples include a December 27, 2022 podcast invitation to WSU Police leadership, January 3 Moscow releases on extradition and nondissemination, and WSU communications describing increased patrols, safe-ride and escort resources, academic flexibility, and employee/student support after the homicides and arrest. Repetition and forwarded chains are substantial; each item’s sender, date, attachment, and status should be verified in the original.
A complete connected extraction of the parking-control table contains 300,667 rows with the fields PlateNumber, ColorDesc, MakeDesc, ModelDesc, and StateDesc. The profile contains 257,609 distinct plate strings and 70 distinct state/territory descriptions. Literal-field checks found 753 rows combining WHITE with a HYUN make code, two rows containing CFB8708, and one row containing LFZ8649. Those matches are data observations only: the workbook does not itself establish the driver, ownership, relevance, or whether duplicate rows reflect separate events.
A complete extraction of the active-vehicle-on-permit workbook contains 10,538 rows and 19 exported fields covering permit number, plate, state, registration expiration, VIN/VIN4, registration number, year, color, body, make, model, and plate type. The profile includes 10,536 distinct permit strings, 8,223 distinct plate strings, 54 state-code values, 40 nonblank distinct full-VIN strings, and vehicle years ranging from 1967 to 2022 where populated. One row contains the literal plate string CFB8708. The filename’s numeric date range is ambiguous and is not silently interpreted.
A complete extraction of the LPR GPS Coordinates workbook contains 30,368 dated read rows from November 6 through November 15, 2022. The table includes read date, geofence, plate string, latitude, and longitude, with 9,663 distinct plate strings, 107 geofence labels, and 6,947 distinct coordinate pairs. “Other” is the largest geofence category, followed by several numbered WSU lots. No rows contain the literal strings CFB8708 or LFZ8649. Absence of those exact strings is not proof that a vehicle was absent: plate formats, recognition error, coverage, query scope, and missing data remain material limitations.
This record indexes “Screenshot_20250708-134958.PNG,” a social-media screenshot or image stored in the Social Media Archive section “4chan Posts.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “Screenshot_20250708-135045.PNG,” a social-media screenshot or image stored in the Social Media Archive section “4chan Posts.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “Screenshot_20250708-135412.PNG,” a social-media screenshot or image stored in the Social Media Archive section “4chan Posts.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “Screenshot_20250708-135505.PNG,” a social-media screenshot or image stored in the Social Media Archive section “4chan Posts.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “Screenshot_20250708-135945.PNG,” a social-media screenshot or image stored in the Social Media Archive section “4chan Posts.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “Screenshot_20250708-140104.PNG,” a social-media screenshot or image stored in the Social Media Archive section “4chan Posts.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “Screenshot_20250708-140205.PNG,” a social-media screenshot or image stored in the Social Media Archive section “4chan Posts.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “v12044gd0000cog804nog65me8pr5jdg.MP4,” a video/mp4 file stored under “Josh Ferraro TikToks .” Drive confirms the file identity and size, but no reliable transcript, captions, speaker identification, or complete timestamp map was available through the connected extraction. The record therefore makes no action-level or dialogue-level claims and links to the original media for direct review.
This record indexes “Capture.JPG,” a social-media screenshot or image stored in the Social Media Archive section “Rumors.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “lihv.JPG,” a social-media screenshot or image stored in the Social Media Archive section “Rumors.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “bn_01273.png,” a social-media screenshot or image stored in the Social Media Archive section “Steve G & Brat Norton Messages.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
This record indexes “bn_03713.png,” a social-media screenshot or image stored in the Social Media Archive section “Steve G & Brat Norton Messages.” The artifact is preserved for provenance, but searchable source text is withheld because this section may contain private communications, payment activity, anonymous accusations, health-related posts, harassment, or unverified account attribution. The record does not authenticate an account, identify a user behind a handle, or treat statements in the artifact as established facts.
Source file “ES Surveillance 11.13.22 526am_6_01_R_20221113050000_Redacted.mp4” from Security Camera Footage › E&W. The original file remains in Google Drive. This entry indexes the supplied filename and folder placement; the recording itself has not been reviewed.
Source file “03___Entrance GROC_Friday January 6 202332708 e1a5a92.avi” from Security Camera Footage › Walmart › 11 › 17 › 22. The original file remains in Google Drive. This entry indexes the supplied filename and folder placement; the recording itself has not been reviewed.