From:
To:
Subject:
Date:
abagbD;
Fwd: RE: Epstein search warrant documents
Tuesday, May 12, 2020 11:31:40 AM
Gents,
See the thread below as an FYI.
NY CART Coordinator
Senior Forensic Examiner
cell
desk
-------- Forwarded message ------(USANYS)"
(USANYS)
[Contractor
Cc: "
(USANYS)"
I have no doubt you do, but can you please tell us what that plan is? Thanks!
From:
) <=e
To:
(USANYS) [Contractor] <
•>;
(usArtes)
Cc:
(USANYS)
IM
(USANYS)
I will use the spreadsheet, no problem.
and I ironed out all the details. We've got a good
plan moving forward that will meet your needs.
NY CART Coordinator
Senior Forensic Examiner
cell
desk
On May 12, 2020 10:34 AM,
wrote:
it would be very helpful for us if you could please use the attached spreadsheet in
transmitting that info so we make sure we get all the info we need. I think you had previously sent
us a list of certain information that unfortunately wasn't helpful for us, so we want to make sure
we're all on the same page.
(USANYS)"
3503-021
Page I of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001936
EFTA00157120
In terms of data transfer,
are you just sending a literal copy of all the raw data, and we'll
process and upload it on our end? I ask to make sure we don't lose any searchability — when FBI
sent versions before, it had already been processed. I think what we talked about on the phone a
month ago was getting, for example, data from one device to make sure it transfers correctly, before
sending over literally everything — is that still the plan?
thanks,
From:
(USANYS) (Contractor] <
>
To:
(USANYS)
Cc:
4t
>
Hello S,
Me and
lust finished our phone call regarding the data.
will put together a list of
the all of the data and where the data was collected. I will work to send some hard drives to
so he can begin to copy the data and send it to us. I will need to figure out a way to get the
data off of the hard drives.
Please let us know if there are any questions.
Thank you.
From:
(USANYS).
To:
<
E>;
(USANYS)
(USANYS)
Cc:
C
(USANYS) [Contractor] a;
<
>;
<
)*;
. (NY) (FBI) a
(USANYS)
(USANYS)
Okay thanks — please do let us know if at any point that changes, otherwise we'll look forward to
being able to review the returns in early June. Thanks again.
3503-021
Page 2 of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001937
EFTA00157121
From:
) "ca
To:
(USANYS)
(USANYS)
a
>,
(USANYS)
Cc:
(USANYS) [Contractor) a;
(USANYS)
c
=';
<
•
(USANYS)
(NY) (FBI)
There has been talk of us returning to normal soon, so I don't think it will effect the timeline I
initially gave you. If it does, I'll let you know.
NY CART Coordinator
Senior Forensic Examiner
cell
desk
On May 8, 2020 1:58 PM,'
(USANYS)"
wrote:
Understood, thanks—it will be great to get that list on Thursday. As a refresh, the info we are
looking for is in the attached spreadsheet template.
On the returns themselves, do the changes you mentioned mean that the estimate of a month from
now for complete transmission of the search warrant returns is no longer likely? If so could you
please let us know what the current estimate would be, so we can factor that in? Thanks very much.
From:
) tta
To:
(USANYS)
(USANYS)
a
>i
;USANYS)
Cc:
(USANYS) [Contractor) a;
(USANYS)
'_a;
(USANYS)
(NY) (FBI) a
Sony for the delay, they reduced us to I day a week, so things have been stretched out by a
factor of 5. I will be back in the office on Thursday and will be able to get you the list then as I
have to access some of our systems to do so.
Also, =,
please reach out to me at one of the numbers below so we can brain storm.
Thanks.
3503-021
Page 3 of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001938
EFTA00157122
NY CART Coordinator
Senior Forensic Examiner
cell
desk
0:?.a
,4, 1
MEI
(USANYS)"
wrote:
Following up on the below, I think you had said you expected to be able to get us a list of the devices
seized from the search warrants at Epstein's residences in New York and the USVI, as well as from his
person upon arrest, in about a month (during our conference call a month ago) — so wanted to check
if we can still expect that very soon? We're waiting on that list to be able to do an updated search
warrant on all of those devices. Please let us know the current timeline — and also the current
timeline on producing the results from those August and September searches? I think you and =I
were going to coordinate on that, and you had mentioned you expected we'd have it a couple
months from our call, which would be about a month from now. Wanted to make sure we're still on
track.
thanks,
From:
aNIME>
To:
(USANYS) <
(USANYS)
(USANYS)<
>
Cc:
(USANYS) [Contractor) <
:,;
(USANYS)
c
›;
(USANYS)
NT/ (FBI)<
>
Ok let's plan on 11am tomorrow morning, I am trying to get an FBI line with a larger capacity but I
won't know until tomorrow am. I will push it out when confirmed.
Thanks
From:
(USANYS)
To:
)
(USANYS)
Cc:
(USANYS) [Contractor) c:I
>
(USANYS)
(USANYS)
3503-021
Page 4 of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001939
EFTA00157123
(USANYS)<
>
.
(NY) (FBI)
Yes, I can do anytime tomorrow, and
can also join anytime tomorrow. So whenever is
good on your end.
Also, we can host a conference call, but only up to six lines at a time — so if FBI has larger capacity
than that let us know, otherwise I'd propose we do:
3) MI
4) -
S)
6)
/M
g if either of you wants to join (and if not, one of
From:
To:
(USANYS)
;
"c
>i
(USANYS)
(USANYS) <
>
Cc:
(USANYS) [Contractor) •,t
=•;
(USANYS)
(USANYS)
(NY) (FBI) ‹
>
Are you available tomorrow for a conference call to discuss this issue?
SSA
FBI New York
On
(USANYS)"
wrote:
Following up on this from a month ago — I know we're living in a different world than what existed
four weeks ago, but are you at all able to assist while working remotely? This has been pending for
almost two months and we still don't have a very basic list of each device or item that was seized
and searched, or for which of those we've received materials. We're happy to have a call if that
would be useful, but as a first step the most basic thing we're looking for is the info in the template
spreadsheet we sent earlier (that's also attached).
3503-021
Page 5 of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001940
EFTA00157124
thanks,
From:
(USANYS)
To:
(USANYS)
<a;
(USANYS)
Cc:
(USANYS) [Contractor] .t
e;
(USANYS)
CE
>;
(USANYS)
. (NY) (FBI) <
>
Unfortunately I don't think this is very helpful to us. Did you take a look at the example spreadsheet
I sent on 2/24? The excel file you sent has descriptions that don't match up to the items listed in the
search warrant returns (that we sent on 2/23), and we don't have the 1B or CART numbers to be
able to cross-reference. We also can't tell what you mean by "loose media" without a specific
comparison to what was seized, we don't know which items you're referring to as "Windows
machines," and we can't tell whether the entirety of any particular item has been transferred, or just
partial. For example, it looks like we have gotten very, very few image files, which is surprising.
We have also encountered some very significant problems in trying to review the more than 1
million documents we recently received:
The data we've received has no way to put any emails and attachments together. So if an
email says, "see the attached flight records," for example, we have no way of linking that up
with the records themselves. Not only is that a big problem for us in review, it's going to be
a huge problem for producing the documents to defense counsel.
-
The load file has no link to the native file, so when we load the data to the database, there's
no way to have the native files show up in the database. Because many of the files are too
large to open in the viewer, it effectively means that there are many files that are completely
invisible to us.
Related, the control numbers in the load file don't match up to the native files. So we have
two sets of numbers and no way to match up anything—that is, even if we were to try to go
hunt down every individual large file in the native files, it would be impossible.
So the data that we most recently got, we need to get in a form that addresses those issues, and we
likely will need to get a similar reproduction of the data we received a couple months ago.
Otherwise we're sifting through more than a million documents without much rhyme or reason.
I've re-attached the spreadsheet we sent last week — I think that's a good place to start in terms of
3503-021
Page 6 of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001941
EFTA00157125
our necessary record-keeping, and we need that info at the very least, as well as anything else you
think would be useful. Also attaching the SW returns for reference. And again, we're happy to meet
up anytime and hash all this out in person if that's useful.
thanks,
From:
To:
(USANYS)
<
>:
(USANYS)
Cc:
(USANYS) [Contractor] <
>:
(NY) (FBI)
(USANYS)
(USANYS)
(USANYS)
Here is a listing of what I have already handed over in load files to the US Attorney's Office for taint
review. Some points of clarification: There were 9 IDE hard drives found in the Manhattan
apartment, they turned out to be 3 copies of 3 drives (9 drives in total) from a July 2007 search on
one of his properties. I only processed 3 (as they were all copies). All the loose media from the NY
apartment is included. All the Windows machines from the NY apartment are included. Only 2 Macs
from NY and 1 from the Island are included.
I will have to more closely coordinate with whoever is loading up Relativity with the
remaining Macs as the tool they have to be processed with does not easily re-name the load files.
Spreadsheet is attached.
NYO CART Coordinator
Senior Forensic Examiner
(office)
(cell)
From:
(USANYS)
•
To:
c
(USANYS)
(USANYS)
Cc:
(USANYS) [Contractor]
(USANYS) ffi
;
(USANYS)
(NY) (FBI) <
>
3503-021
Page 7 of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001942
EFTA00157126
I could do Thursday morning, but I think it would be helpful for us to get the accounting in advance
of the meeting so we can figure out in advance what (if any) additional steps we need — is that
possible?
From:
To:
(USANYS)
>;
(USANYS)
(USANYS)
Cc:
(USANYS) [Contractor) <
:,;
(USANYS)
c
>;
(USANYS)
(NY) (FBI) <
M>
Can we do Thursday morning? My network should be back by then and I can give you a good
accounting.
NY CART Coordinator
Senior Forensic Examiner
cell
desk
On Mar 2, 2020 11:15 AM, '
wrote:
Doing the weekly check in on this — is there a time this week when everyone can meet on this?
(USANYS)"
thanks,
From:
(USANYS)
To:
'c
›;
(USANYS)
(USANYS) <
E>
Cc:
(USANYS) [Contractor) <
:.;
(USANYS)
(USANYS)
(NY) (FBI)
Totally understand about the network issues—we can relate. I do still think it will be helpful to all sit
down together to have an in-person discussion, to make sure everybody is on the same page. Are
folks available for that next week? And what I think would be most helpful to facilitate that would
3503-021
Page 8 of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001943
EFTA00157127
be a spreadsheet of each separate device referenced in the two search warrant returns, with
columns for whether we've dumped the contents, whether they've been reviewed and/or
transferred, what portions were transferred, etc.
Something roughly like the attached, with any other categories you think would be useful — and the
info on the attached is mostly hypothetical, obviously, just as examples. That will help us fully
understand what's been reviewed, transferred, and received so far, and what remains.
(Also just on the pictures, we do want copies of those as well, please including from the discs and
the devices — I think FBI was going to do an initial screen to make sure no CP, and since I think the
answer was no, we'll need to get those to be able to review them as well.)
many thanks,
From:
a
To:
(USANYS) <
,USANYS) <
Cc:
(USANYS) (Contractor)
(USANYS)
>,
>:
(USANYS)
(NY) (FBI)
(USANYS)
Sorry for the delayed response. They are tearing out our old network and giving us a new one,
they mandated we delete old stuff (about 400 TB worth). Now that they are working on
replacing the network, we can do only local work. I should be able to give you an accounting
of what is what. I can say, off the top of my head, that all windows based items from the NY
search have been handed over as well as all loose media. The CDs from NY only contained
pictures, no documents. There are still some Apple items from NY that need to be produced.
As far as the Island stuff goes, the 1st item on your spreadsheet, the "kitchen" mac has been
produced. Still working on the rest.
NY CART Coordinator
Senior Forensic Examiner
cell
desk
?nFel 23, 2020 12:21
r
(USANYS)"
wrote:
Team,
Following up on the below from last weekend, I'm still not sure how we're addressing this so I
thought it would make sense for us to all schedule a (hopefully relatively brief) meeting to all get on
3503-021
Page 9 of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001944
EFTA00157128
the same page? We didn't hear back on which files had previously been provided, but our tech folks
did their best to differentiate, and we got access to the materials yesterday and its well over a
million documents, and we don't have any idea what we're looking at — i.e., which devices the
materials came from, whether it's full or partial results, how many more devices we have coming,
etc.
Based on the attached search warrant returns, it looks like from the New York mansion (the PDF)
there are approximately 40 devices that would have storage (computers, hard drives, thumb drives,
etc.) and that's not even counting at least 60+ CDs. And then from the Virgin Islands (the Excel
spreadsheet), at least more than 25 devices, including multiple servers / server racks.
So we gotta know what we've already received, what remains, anticipated schedule, etc, and I know
it's a lot of moving pieces on all sides so wanted to loop in everybody at once. The case team will be
in California this coming week from Tuesday through Friday, but then I think generally around the
first week of March, which will hopefully be plenty of time to schedule a productive meeting.
thanks all,
From:
(USANYS)
To:
<
)';
Cc:
(USANYS) [Contractor] a>,
. (NY) (FBI)
(USANYS)
(USANYS)
I'm not sure who's the exact right person to ask this, so wanted to get everybody on one email chain
about it — I have the hard drive that
dropped off that has new Epstein search warrant
materials, but it looks like there are also old materials (that I think we had previously received and
uploaded??) on the hard drive, and so I'm not sure what's new.
Just generally, and
and I talked about this last week too, but it's basically impossible for us to
keep track of what we're getting, and what has been completed, without some kind of identification
or labeling system, along with a list of which devices have been extracted and downloaded.
So for example on the hard drive currently, there are 38 folders labeled "loadFiles" through
"37loadFilesn with a modified date of 11/14/19, which I think we may have already previously
received — but I'm not sure, because we haven't gotten any info on which folders match up to which
devices, etc. And then there's another folder titled "NYCO24362" that has a modified date of
1/27/20, so I think that may be the materials we hadn't previously received? That folder by itself has
3503-021
Page 10 of 11
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001945
EFTA00157129
more than 600,000 items.
I don't want to give
anything that we've already previously received and uploaded, and I can't
tell from the folder or file names whether everything on the drive is new, or whether just additional
materials were saved onto it in addition to what we already have. =,
are you able to give us
some guidance on this? Ultimately what we really need is a spreadsheet of every device, whether
it's been dumped (or partially dumped), and then identifying that same info — which device, and
what materials from it — are being given to us with each data transfer. Otherwise I think
organizationally and for review purposes it will be a total disaster for us.
We're happy to have a meeting on this if that's helpful — and thanks everybody for the assistance.
Assistant U.S. Attorney
Southern District of New York
3503-021
Page 11 of I 1
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17
EFTA_00001946
EFTA00157130