EFTA01649116

From: (WF) (FBI)" ala> To: FBI " r FBI (WF) (FBI, )" ai (WF) Subject: Re: 50D-NY-3027571 1B Items Date: Tue, 11 Mar 2025 13:25:07 +0000 Importance: Normal Good morning! The first restore is moving quickly and on track to be done tomorrow. Then we will kick off the 6TB restore. have given case access to SA and SOS y. TF0 and IA=s all need to have their DCAP accounts either created or re-activated if they have expired. Please let me know if you would like any additional updates. Otherwise I can go directly with SSA future updates. Thanks From: (NY) (FBI) c > Sent: Monday, March 10, 2025 9:15 PM To: (WF) (FBI) < >; . (WF) (FBI) <->; (FBI) < =';-. (NY) (FBI) < Cc: (WF) (FBI) M=e, (WF) (FBI) < (NY) (FBI) < (NYPD) < >; (NY) (FBI) < c > Subject: Re: 50D-NY-3027571 1B Items Thank you! +SAM= TFO== , Si (NY) (FBI) < for (WF) >S, >; (NY) (FBI) las, and SOS They are the case team w SSAMIand will need access to DCAP. ASAC FBI NY Violent Crime Threat Cell: From: (WF) (FBI) aME> Sent: Monday, March 10, 2025 8:24:45 PM To: . (NY) (FBI) .(V4 ,)(FEA<a>; (WF)(FBI) aME›; . (NY) (FBI) EFTA01649116 Cc: (WF) (FBI) alME:bl Subject: Re: 50D-NY-3027571 1B Items (WF) (FBI) aME> Restore of the first set (8.5TB ) kicked off successfully. Will know more about timing tomorrow! Once that is completely restored, we will start the second restore job (about 6TB). Please let me know to whom I should provide access on DCAP, at your earliest convenience. Thank you, From: Sent: Monday, To: (FBI) < Cc: (WF) (FBI) < Subject: Re: 50D-NY-3027571 1B Items (WF) (FBI) March 10, 2025 8:17 PM (NY) (FBI) < :.; (WF) (FBI) <az.; >, . (NY) (FBI) <fl> (WF) (FBI) c > (WF) Working with OTD remotely now to start the data archive unpacking. Will advise when this step is complete, and we have a total time to restore estimate. We are looking at a total of approximately 14.6 Terabytes of archived data to unpack. I have already uploaded and verified 1B146 (Optical media) to DCAP and 18136 is secured until we can determine the best way to move forward with it (obscene material). Please let me know if you have any questions or concerns. Thanks SSA Digital Forensic Examiner FBI WFO CART Desk: Cell: From: (WF) (FBI) < > Sent: Monday, March 10, 2025 7:30 PM To: . (NY) (FBI) a; (WF) (FBI) a; (WF) (FBI) a; (WF) (FBI) 'Ma; (FBI) ca; (WF) (FBI) sc il>; (NY) (FBI) ‹ > Subject: Re: SOD-NY-3027571 18 Items All the items have been passed to WFO CART. Special Agent FBI Washington Field Office Child Ex loitation and Human Trafficking Task Force Cell: (WF) (FBI) (WF) From: own (FBI) Sent: Monday, March 10, 2025 6:15:34 PM EFTA01649117 (NY) (FBI) . (WF) (FBI) (WF) (FBI) (WF) (FBI) Subject: Re: 50D-NY-3027571 I B Items (WF) (FBI) ; (WF) (FBI) ; (WF) (FBI) . (NY) (FBI) and I have all the items and are en route back to NVRA. We will provide an the transport is done and the items have been passed to WFO CART. Special Agent FBI Washington Field Office Child Ex loitation and Human Trafficking Task Force Cell: From: Sent: Monday, • (NY) (FBI) aME> March 10, 2025 4:53:19 PM To: (WF) (FBI) (WF) (FBI) • (WF) (FBI) (WF) (FBI) • Subject: Re: 50D-NY-3027571 I B Items Thank you! ASAC FBI NY Violent Crime Threat Cell: (WF) (FBI) ; (WF) (FBI) (WF) (FBI) . (NY) (FBI) From: (WF) (FBI) Sent: Monday, March 10, 2025 4:41:03 PM To: (WF) (FBI) < >; (WF) (FBI) (WF) (FBI) .: >; (WF) (FBI) 'ca; (WF) (FBI) .: >; (WF) (FBI) <=a; . (NY) (FBI) < >; (NY) (FBI) ‹ > Subject: 50D-NY-3027571 1B Items All, Per guidance from A/ADIC , we are sending 2x SAs now to pick up the below 18 items for passage to WFO CART. Per conversations with Oa, WFO CART is the best situated to handle the decompression of 18144 and 1B145, and 18146 is believed to have logs that will assist with understanding the previous work completed by CART on this case. 1B136 contains CSAM and will be handled per policy. : See below items that and=will be transferring to NVRA. They will be at the V Street ECR in approximately one hour. NY: FYSA and= will be in touch re arrival. SOD-NY-3027571 18 Details: EFTA01649118 • 18136: Highly responsive material to include nude images and videos from digital evidence processed. This information is potentially not in Relativity due to the sensitive nature of the images, which could include CSAM. Portable hard drive. • 18144: Two LTO 6 tape cartridges containing an Arcserve backup of digital evidence. • 18145: Three LTO 6 tape cartridges containing an Arcserve backup of digital evidence. o LTO tapes (Linear Tape Open) are used for backup and archiving data. These LTO tapes require a specific system to decompress the archive and restore it to our network for review. The LTO tapes in this case file can hold approximately 12.5 Terabytes (5 tapes of 2.5TB). We believe 18144 and 18145 will contain a backup of all digital evidence in the case file, however we will need to process the LTO tapes to confirm. • 18146: One DVD-R containing log files and FTK reports. Admin logs that may help us better understand CART processing of digital evidence in the case. Thank you for all the assistance. Washin ton Field Office Cell: EFTA01649119