Text extracted via OCR from the original document. May contain errors from the scanning process.
III (Rev. 08.15.20171
4
/
1111
UNCLASSIFIED
Federal Bureau of Investigation
Digital Evidence Laboratory
To:
New York
SA
Request Date:
Ref. No:
"Lille:
August 16, 2019
Serial 58
UNSUB(S);
Date item(s) received: August 16, 2019
Item(s) submitted:
I IQQ019594:
HQQ019333:
HQQ019334:
HQQ019595:
HQQ019596:
HQQ019331:
Page 1 of 9
ERF Building 27958A
Quantico. VA 22135
Date:
June 16, 2021
Case ID:
090A-NY-3151227
Request No.: HQQ190816001
DVR, Dell, PowerEdge R420, SBMQZI2, 1B20, One (1) DVR System
Controller (Examined)
Hard Drive, Dell, WD5003ABYX-18WERA0, WMAYP0DFPY4F, 1B20, One
(1) hard disk drive from Bay 1 of DVR System Controller. (Examined)
Hard Drive, Dell, WD5003ABYX-18WERA0, WMAYP0DNCDAV, 1B20,
One (1) hard disk drive from Bay 2 of DVR System Controller. (Examined)
DVR, NICE Systems, SA-6640S, F96168201-004, 1B19, One (1) DVR Disk
Array (DVR 2) (Examined)
DVR, NICE Systems, Nicevision PRO (NP-2000), 43144902, 1B19, One (1)
DVR Disk Array Controller (DVR 2) (Examined)
Hard Drive, Seagate, ST3320620AV, 9QFCN325, 1B19, One (1) hard disk
UNCLASSIFIED
An Accredited Labccatoni
Since January 16, 2007 weeneesrae
ANEMIC MIAMI
EFTA00064185
UNCLASSIFIED
HQQ019597:
HQQ018772:
HQQ018773:
HQQ018774:
HQQ018775:
HQQ018776:
HQQ018777:
HQQ018778:
HQQ018779:
HQQ018780:
HQQ018781:
HQQ018782:
HQQ018783:
HQQ018784:
HQQ018785:
HQQ018786:
HQQ018787:
HQQ019598:
HQQ190816001
090A-NY-3 151227
Page 2 of 9
drive from top bay of DVR 2 Disk Array Controller. (Examined)
DVR, NICE Systems, Premium 8600, 232476, 1B21, One (1) DVR Disk Array
(DVR 1) (Examined)
Hard Drive, Western Digital, WD3200AAJB, WCAV21723809, From Bay 1 of
HQQ019597 (Examined)
Hard Drive, Seagate, ST3320620AV, 9QF7PFHZ, From Bay 2 of HQQ019597
(Examined)
Hard Drive, Seagate, ST3320620AV, 9QF7P84L, Drive from Bay 3 of
HQQ019597 (Examined)
Hard Drive, Seagate, ST3320620AV, 9QFCM8PR, From Bay 4 of
HQQ0 19597 (Examined)
Hard Drive, Seagate, ST3320620AV, 9QF649J4, From Bay 5 of HQQ0 19597
(Examined)
Hard Drive, Seagate, ST3320620AV, 9QF7NJTG, From Bay 6 of HQQ0 19597
(Examined)
Hard Drive, Seagate, ST3320620AV, 9QFB0S6N, From Bay 7 of HQQ0 19597
(Examined)
Hard Drive, Seagate, ST3320620AV, 9QFB0P1Q, From Bay 8 of HQQ0 19597
(Examined)
Hard Drive, Seagate, ST3320620AV, 9QF7P8W1, From Bay 9 of HQQ0 19597
(Examined)
Hard Drive, Seagate, ST3320620AV, 9QF7PFPY, Bay 10 of HQQ0 19597
pcarnined)
Hard Drive, Seagate, ST3320620AV, 9QFCM7CS, From Bay 11 of
HQQ019597 (Examined)
Hard Drive, Seagate, ST3320620AV, 9QF9Q0F5, From Bay 12 of
HQQ0 19597 (Examined)
Hard Drive, Maxtor, MaXLine II, A830RYBE, Drive from Bay 13 (Examined)
Hard Drive, Western Digital, WD3200AAJB-00J3A0, WCAV21023754, From
Bay 14 of HQQ019597 (Examined)
Hard Drive, Seagate, ST3320620AV, 9QFCJV3P, Bay 15 of HQQ0 19597
(Examined)
Hard Drive, Seagate, ST3320620AV, 9QF7N0SX, From Bay 16 of
HQQ0 19597 (Examined)
DVR, NICE Systems, Nicevision PRO (NP-2000), 43144901, 1B21, One (1)
UNCLASSIFIED
EFTA00064186
UNCLASSIFIED
HQQ018525:
HQQ018526:
HQQ019599:
HQQ019600:
HQQ019601:
HQQ019602:
HQQ019603:
HQQ019604:
HQQ019605:
HQQ019606:
HQQ019607:
HQQ019608:
HQQ019609:
HQQ019610:
HQQ01961I:
HQQ019612:
HQQ019613:
HQQ190816001
090A-NY-3151227
Page 3 of 9
DVR Disk Array Controller (DVR 1) (Examined)
Hard Drive, Maxtor, DiamondMax 10 (6L080P0), L25C8D3G, 1B21, One (1)
hard disk drive from top bay of DVR 1 Disk Array Controller. (Examined)
Hard Drive, Maxtor, DiamondMax 10 (6L080P0), L25CF5QG, 1821, One (1)
hard disk drive from bottom bay of DVR 1 Disk Array Controller. (Examined)
Hard Drive, Seagate, ST500DM002, Z3T6C.JJA, 1BI, One (1) hard drive
(E6516194) (Examined)
Hard Drive, Hitachi, HDS721050CLA662, JP1572.1E36A13K, 182, One (I)
hard drive (E6516195) (Examined)
Hard Drive, Seagate, ST500DM002, Z3T6CF5X, 183, One (1) hard drive
(E6516196) (Examined)
Hard Drive, Seagate, ST3500320NS, 9QM8MT9P, 1134, One (1) hard drive
(E6516197) (Examined)
Hard Drive, Hitachi, HDS721050CLA662, JP1572JE36MWNK, 1B5, One (1)
hard drive (E6516198) (Examined)
Hard Drive, Seagate, ST3500320NS, 9QM8EC75, 1B6, One (1) hard drive
(86516199) (Examined)
Hard Drive, Seagate, ST500NM0011, Z1M1PZPE, 1B7, One (1) hard drive
(E6516200) (Examined)
Hard Drive, Western Digital, WD5000AVDS, WCAV9Z911026, 188, One (1)
hard drive (E6516201) (Examined)
Hard Drive, Western Digital, WD5000AAKX, WCC2EJUC34CJ, 1B9, One (1)
hard drive (86516202) (Examined)
Hard Drive, Seagate, ST3500320NS, 9QM8MSEZ, 1810, One (1) hard drive
(E6516203) (Examined)
Hard Drive, Seagate, ST3500641A, 3PO00Q5E, Partial image of DVR 2
system drive (Examined)
CD-R, Photos of bad drives. (Examined).
Hard Drive, Seagate, ST500NM0011, Z1M1PX26, 1811, One (1) hard drive
(E6516204) (Examined)
Hard Drive, Seagate, ST500NM0011, ZIMIQIFX, 1812, One (1) hard drive
(E6516205) (Examined)
Hard Drive, Western Digital, WD5000AVDS, WCAV9T870016, 1813, One (1)
hard drive (86516206) (Examined)
UNCLASSIFIED
EFTA00064187
UNCLASSIFIED
HQQ019614:
Hard Drive, Western Digital, WD5000AAKX, WCC2E0DE83YK, 1B14, One
(1) hard drive (E6516207) (Examined)
HQQ0I9615:
Hard Drive, Seagate, ST3500320NS, 9QM8MT6D, 1B15, One (1) hard drive
(E6516208) (Examined)
11QQ019616:
Hard Drive, Seagate, ST500NM0011, Z1M1PZ07, 1B16, One (1) hard drive
(E6516209) (Examined)
HQQ019617:
Hard Drive, Seagate, ST500NM0011, Z1M1L0YG, 1B17, One (1) hard drive
(E6516210) (Examined)
HQQ019618:
Hard Drive, Seagate, ST3500320NS, 9QM8MSRR, 1B18, One (1) hard drive
(E6516211) (Examined)
HQQ019619:
Hard Drive, Seagate, ST1000DM003, S1D85PLA, 1B22, Clone of 1B1
(E6515200) (Examined)
HQQ019620:
Hard Drive, Hitachi, HUA722010CLA330, N039F71 T 1B23, Clone of IB2
(E6515201) (Examined)
HQQ019621:
Hard Drive, Seagate, ST1000DM003, Z1D3ZSS0, IB24, Clone of 1B3
(E6515202) (Examined)
HQQ019622:
Hard Drive, Seagate, ST1000DM003, Z4YDJL1T, 1B25, Clone of 1B4
(E6515203) (Examined)
HQQ019623:
Hard Drive, Seagate, ST1000DM003, Z4YDHX5M, 1B26, Clone of 1B6
(E6515204) (Examined)
HQQ019624:
Hard Drive, Seagate, ST1000DM003, W1D48YH6, 1B27, Clone of 1B7
(E6515205) (Examined)
HQQ019625:
Hard Drive, Western Digital, WD10EADS, WCAU45803950, 1B28, Clone of
1B8 (E6515206) (Examined)
HQQ019626:
Hard Drive, Seagate, STI000DM003, Z4Y00Q48, 1B29, Clone of 1B9
(E6515207) (Examined)
HQQ019627:
Hard Drive, Seagate, ST1000DM003, W1D496N0, 1B30, Clone of 1B10
(E6516228) (Examined)
HQQ019628:
Hard Drive, Seagate, STI000DM003, Z1DB25CT, 1B31, Clone of 1B11
(E6516229) (Examined)
HQQ019629:
Hard Drive, Seagate, ST1000DM003, W1D48Z6E, 1B32, Clone of 1B12
(E6516230) (Examined)
HQQ019630:
Hard Drive, Western Digital, WD1003FZEX, WCC3F2783519, IB33, Clone of
IBIS (E651623 I) (Examined)
HQQ019631:
Hard Drive, Seagate, ST1000DM003, S1D9GK9P, 1B34, Clone of 1B16
HQQ190816001
090A-NY-3 151227
Page 4 of 9
UNCLASSIFIED
EFTA00064188
UNCLASSIFIED
(E6516232) (Examined)
HQQ019632:
Hard Drive, Seagate, ST1000DM003, S1D9DETC, 1B35, Clone of 1B17
(E6516233) (Examined)
HQQ019633:
Hard Drive, Seagate, STI000DM003, W1D06T5L, 1B36, Clone of 1B18
(E6516234) (Examined)
Summary:
Per Electronic Communication (EC) dated 8/26/2019, Special Agent (SA) -
-transferred
the submitted specimens from the New York field office to the Operational
Technology Division/Digital Forensics Analysis Unit (OTD/DFAU) in Quantico for examination. The
specimens were received by the Computer Analysis Response Team (CART) for analysis.
Per discussion with CART Laboratory Supervisor
on 8/19/2019, the Digital Video
Recorder (DVR) system is to be assembled to allow export of videos contained on the system.
The DVR system consisted of a main controller and 2 disk arrays, labeled as DVR 1 and DVR 2.
DVR 1 was assembled successfully and made available for export of videos. Video Specialist
performed exports based on requests made by the NY investigative team. On 12/19/2019,
DVR 1 failed due to hardware issues. Contact with the vendor and attempts to use replacement parts
were unsuccessful in restoring the disk array to a usable state.
DVR 2 contained 3 hard disk drives that were repaired by Advanced Data Recovery Specialist
However, DVR 2 was never able to be assembled successfully. A review of the logs on the
DVR 2 controller indicated catastrophic disk failures before receipt by the FBI.
A master copy of the images of the hard disk drives contained in the DVR system were placed on to 3
hard drives for storage (labeled as HQQ026637-HQQ026639).
Details of Examination:
The dates of this examination were August 20, 2019 through May 24, 2021.
HQQ190816001
090A-NY-3151227
Page 5 of 9
UNCLASSIFIED
EFTA00064189
UNCLASSIFIED
The submitted items were parts of a DVR system, overview as follows:
1B#
AQQ#
Item
Contents
1820
' HQQ019594
in Controller
Contained 2 drives
11321 (2 of 2)
HQQ019598
DVR 1 Controller
1821 (1 of 2)
HQQ019597
DVR 1 Disk Array
Contained 2 drives
Contained 16 drives
1819 (2 oft)
1819 (1 oft)
HQQ019596
DVR 2 Controller
HQQ019595 IDVR 2 Disk Array
Array is empty
Contained 1 drive
The hard disk drives contained in the units were write blocked and forensic images created as follows:
Main Controller - Forensic images of the 2 drives were created to a forensically clean network share
in Quantico for archive. Forensic copies of the drives (clones) were also created on additional
physical drives to be used in the unit for assembly. These actions were performed by FE
DVR 1 Controller - The top bay drive was repaired by Recovery Specialist
Forensic
images of the 2 drives were created to a forensically clean network share in Quantico for archive.
Forensic copies of the drives (clones) were also created on additional physical drives to be used in the
unit for assembly. These actions were performed by FE
DVR 1 Disk Array - Forensic images of the 16 drives were created to a forensically clean network
share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional
physical drives to be used in the unit for assembly. These actions were performed by FE
DVR 2 Controller - Forensic image of the 1 drive was created to a forensically clean network share in
Quantico for archive. A forensic copy of the drive (clone) was also created on an additional physical
drive to be used in the unit for assembly. These actions were performed by FE
DVR 2 Disk Array - The 16 drives originally contained in the unit were provided to the NY FO.
Forensic images of the 16 drives were created to a forensically clean network share in New York for
archive. Forensic copies of the drives (clones) were also created on additional physical drives to be
used in the unit for assembly. These actions were performed by NY FE's and provided to the CART
team in Quantico.
The DVR system was assembled using the clones and powered on.
The Main Controller started up successfully and was accessed using Administrator password
"!Nicelog" as provided by the vendor. The NICE suite of software, which provides visibility into the
HQQ190816001
090A-NY-3151227
Page 6 of 9
UNCLASSIFIED
EFTA00064190
UNCLASSIFIED
setup and recordings on DVR 1 and DVR 2 was accessed using password "NICE" to gain access to
the administrator functions. A review indicated that roughly half of the camera assignments were
allotted to each DVR.
DVR 1 started up successfully and recordings were available for export through the Main Controller
software interface. DVR 2 did not start successfully.
On 9/18/2019, a meeting was conducted with DVR vendor Technical Support Representative
of SigNet Technologies.
provided an overview of the o eration of the system. A
review of the DVR 2 controller logs by
and Senior Advisor
indicated that
there had been catastrophic disk failures in the array and no recordings would have been available after
7/29/2019. wand
Computer Scientist
were provided access to the beginning
sectors of the 16 drives to see if the structure would indicate clues of a possible rebuild. None were
apparent.
Video Specialist
was provided access to the DVR software and performed exports of the
available recordings on DVR 1 based on investigative team requests.
On 12/19/2019, Video Specialist
reported beeping from the disk array and inability to use the
software to continue to perform exports. A review of the unit indicated memory errors. Attempts at
reseating memory board and RAM were unsuccessful. The vendor was contacted for replacement
parts, but none were available due to the age of the unit. Lab Supervisor
purchased and
provided exemplar memory board and RAM. Several attempts to restore the unit to working order
with replacement parts were unsuccessful and eventually exhausted.
The DVR system original items and clones were returned to NY FO. Master copies of the Main
Controller, DVR 1 images, DVR 2 repaired drive images, and video exports were placed on to hard
disk drives (HQQ026637-HQQ026639) for storage. NY CART Examiners will perform archive of the
DVR 2 images located on the NY FO network share.
Derivative Evidence/Copies:
HQQ018788:
Hard Drive, Western Digital, WD3200AAJB, WCARW3862711, Clone of
HQQO 18772 Bay 1
HQQ018789:
Hard Drive, Western Digital, WD3200AAJB, WCARW4061457, Clone of
HQQ018773 Bay 2
HQQ018790:
Hard Drive, Western Digital, WD3200AAJB, WCARW4061578, Clone of
HQQO 18774 Bay 3
HQQ018791:
Hard Drive, Western Digital, WD3200AAJB, WCARW3816411, Clone of
HQQ018775 Bay 4
HQQ018792:
Hard Drive, Western Digital, WD3200AAJB, WCARW3886572, Clone of
HQQ 190816001
090A-NY-3 151227
Page 7 of 9
UNCLASSIFIED
EFTA00064191
UNCLASSIFIED
HQQ018776 Bay 5
HQQ018793:
Hard Drive, Western Digital, WD3200AAJB, WCARW3914931, Clone of
HQQO 18777 Bay 6
HQQ018794:
I-Iard Drive, Western Digital, WD3200AAJB, WCARW3809038, Clone of
HQQ0I8778 Bay 7
HQQ018795:
Hard Drive, Western Digital, WD3200AAJB, WCARW4064417, Clone of
HQQ0I8779 Bay 8
HQQ018796:
Hard Drive, Western Digital, WD3200AAJB, WCARW3816301, Clone of
HQQ018780 Bay 9
HQQ018797:
Hard Drive, Western Digital, WD3200AAJB, WCARW3915042, Clone of
HQQ018781 Bay 10
HQQ018798:
Hard Drive, Western Digital, WD3200AAJB, WCARW3809320, Clone of
HQQ018782 Bay 11
HQQ018799:
Hard Drive, Western Digital, WD3200AAJB, WCARW3816426, Clone of
HQQO 18783 Bay 12
HQQ018800:
Hard Drive, Western Digital, WD3200AAJB, WCARW3809296, Clone of
HQQ018784 from Bay 13 of IIQQ019597
HQQ01880I:
Hard Drive, Western Digital, WD3200AAJB, WCARW3809224, Clone of
HQQ018785 Bay 14
HQQ018802:
Hard Drive, Western Digital, WD3200AAJB, WCARW3755653, Clone of
HQQ018786 Bay 15
HQQ018803:
Hard Drive, Western Digital, WD3200AAJB, WCARW3816498, Clone of
HQQ018787 Bay 16
HQQ019332:
Hard Drive, Seagate, ST3500630A, 9QG23RDP, Clone of HQQ019331
(top bay of DVR2 Disk Array Controller)
HQQ019335:
Hard Drive, Western Digital, WD1001FALS-41Y6A1, WCATR7962678,
Clone of HQQO 19333 (Bay 1 of Main Controller)
HQQ019336:
Hard Drive, Western Digital, WD15EVDS-73V9B1, WMAVU4005952,
Clone of HQQ019334 (Bay 2 of Main Controller)
HQQ019337:
Hard Drive, Maxtor, DiamondMax 6L300R0, L60YGFBG, Clone of
HQQ018526
HQQ019353:
Hard Drive, Maxtor, 6L200PD, L41RWHTH, Clone of repaired
HQQO 18525
HQQ019354:
Hard Drive, Seagate, ST3500630AS, 9QG4FNAD, Clone of repaired 1B17
HQQ019355:
Hard Drive, Toshiba, dt01aca050, 74J2Z3GAS, Clone of repaired 1B18
HQQ1908 16001
090A-NY-3 151227
Page 8 of 9
UNCLASSIFIED
EFTA00064192
UNCLASSIFIED
HQQ019356:
Hard Drive, Seagate, ST3500410SV, 6VM5VRFN, Clone of repaired 1B14
HQQ019361:
Hard Drive, Seagate, ST5OONM0011, ZIMI6CCO, Clone of repaired 1B13
HQQ019363:
Hard Drive, Seagate. ST5OONM0011, Z1M16CMQ, Clone of repaired 185
HQQ026637:
Hard Drive, Western Digital. WD20EARS-22MVWBO, WCAZA6894206,
Contains Master Copy of DVR Main Controller images.
HQQ026638:
Hard Drive, Seagate, ST100000VN0008, ZPWOKE1R, Contains Master
Copy of DVR 1 images.
HQQ026639:
Hard Drive. Western Digital, WD4003F72X-00Z4SAO,
WMC5D0D9K9RO, Contains Master Copy of DVR 2 controller, DVR 2
repaired drive images, and Video Exports.
Disposition of Items:
All original evidence items and derivative evidence items including Master Copies (HQQ026637-
HQQ026639) were submitted to ColD Evidence Control for delivery to the contributing office. No
electronic evidence is being retained at DFAU Headquarters. The notes of this examination are being
placed in a Digital Evidence Laboratory (DEL) file jacket and being retained in the FBI O11) file.
HQQ 190816001
090A-NY-3 151227
Page 9 of 9
Examiner:
Computer Analysis Response Team Program
UNCLASSIFIED
EFTA00064193