Subject: MXU 20 AUG 2019 Update

From: To: Subject: MXU 20 AUG 2019 Update Date: Tue, 20 Aug 2019 21:25:31 +0000 Importance: Normal Apologies for this being late. Data recovery is getting data from all 6 damaged drives. Should hopefully have everything completed in the next day or 2. Lead HQ examiner has started to inventory and piece together what we have so we can start to reconstitute the raid. Clones arrived from NY via myself this morning and were checked into ECU. They've been retrieved for placement back inside the DVR unit, once we either recieve the hard drive carriers or we find an alternate solution. More tomorrow. On Aug 20, 2019 1:04 PM, rote. av • Critical Incident Support Update - 20 AUG 2019 1300 NY: • DVR from subject residence extracting in NY. Will ingest into Tit once available. • Case team and representatives from Office of the Chief Medical Examiner (OCME) expected to triage priority video this afternoon. • All priority footage has been Ingested. 174 video files available in UK for review. Review ongoing. • Additional files requested for Ingest by case agent. Processing ongoing. • DVR system arrived in QT for recovery. Dayton: • 90 OPA digital tips. All tips have been reviewed. EFTA00161345 • Additional 20 facilities of DVR footage from surrounding area and media sources uploaded to TTK. All facilities have completed processing and are available in UK for review. Review ongoing. • Provided training and case access to 13 CI personnel. • Trained local FAVP on timeline creation workflow. El Paso: SUPPORT COMPLETE AT THIS TIME PENDING TIMELINE CREATION • 223 OPA digital tips. EP is keeping up with review. • 2 targeted DVR pulls from the Walmart loaded in TTK (during the incident and his purchase prior to the incident). All video has been reviewed. • 24 hours of WalMart footage ingested into TTK. Review of 0800-1100 3 AUG timeframe is complete. Awaiting further guidance on additional review requirements. • 1 DVR from ElPaso Health loaded in TTK; All video has been reviewed. • Video from First Convenience Bank located inside WalMart; All video has been reviewed. • Video from Walmart in Allen, TX on 5 AUG 2019; All video has been reviewed • Digital media: Subject's cell phone (EP Review complete), Subject's TD (EP Review complete), Subject's iPad (EP Review complete), Subject's Dell & HP (Review ongoing). • Provided training and case access to 70 personnel (EP, LOOKOUT, DTOS/TDS) • Initial timeline of subject's movements in Walmart provided to EP and available in TTK. Creation of comprehensive timeline in process. Confirmed with EP suspense for timeline is mid-late next week. Gilroy: SUPPORT COMPLETE AT THIS TIME • SF confirmed they do not need additional support at this time. Sent their thanks for the support. • 168 OPA digital tips. SF is keeping up with review. • 1 DVR from residence; all video has been reviewed • 256 bodycam videos; all video has been reviewed • 1 GoPro camera from the scene; all video has been reviewed. • 1 TD containing drone footage uploaded to UK for review. • Videos from professional videographer uploaded to TTK. • Provided training and case access to 9 SF personnel From: Sent: Tuesday, August 20, 2019 12:19 PM Subject: Update 8/20/2019 EFTA00161346 Gilroy: • All digital evidence has been processed and is available on CAIR for review. • Additional digital evidence not expected. • No other significant updates to report. El Paso: • Case and Co-case agent review of 181 (USB Thumbdrive), 183 (iPad), 1B4 (Alcatel Cell Phone), 186 (Dell Optiplex, Desktop) and 1811 (USB Thumbdrive) is underway. • The Austin Taint Team has been given access to 182 (Dell laptop). o EP is awaiting update from Taint Team. o EP is not allowed to have direct contact with the Taint Team so they are also awaiting response from the CDC in order to figure out how to get updates on the Taint Team's progress. • Review of Walmart 24 hour video is about 95% complete. The hours of 8am-11am MDT are fully reviewed, and EP is awaiting further instruction for the rest of the 24 hour video. • No other significant updates to report. • Evidence tracking sheet is attached. Dayton• • CAIR analysis of 1B1/182 (Samsung phone & microSD card) and 183 (Dell laptop) has been completed by the CAIR review team. o CART examiners are taking an additional look at databases and artifacts potentially requiring forensic analysis before finalizing any reporting. • 185 (Dell laptop) has been decrypted by STXU and Cl's hand carried it to CI from Quantico. o CI has finished copying it to OPWAN. They are having issues accessing the image and are working with STXU to address the issues. • 186 (Samsung phone) EDAU is currently not extracting. Legal authority has been updated, but are waiting on the finalized EC authorizing the technique to be used. • 189 (Samsung phone) EDAU is currently not extracting. They do not have updated legal authority nor a finalized EC. • Sinclair Community College body-cam footage is being provided to CART and will be transferred to OPWAN to be provided to MXU once it is reviewed. • All items currently available for processing have been processed and staged for CAIR, pending updated legal authority. • • • o 1B1 (Samsung phone) is being extracted by EDAU since they have legal authority and an EC authorizing the technique to be used. o 187 (laptop) has completed ADLAB processing and is available for CAIR review. No other significant updates to report. Evidence tracking sheet is attached. New York (Epstein): • DFAU is providing updates. EFTA00161347 Houston: • San Antonio CART has personnel on standby to support the Greater Houston RCFL if assistance is needed. • Director Scott Ma was provided contact information for San Antonio CART Coordinator, Jason Bayne, on 8/16/19. EFTA00161348