20190708 153428.636 E (partition.cpp:71]: block index 128 is out of range; block count is 220190708 153433.987 E (partition.cpp:71]: block index 128 is out of range; block count is 2
Case File
efta-efta00281085DOJ Data Set 9Other20190708 153423.378 I (ProcessorBase.cpp:105]: System:
Date
Unknown
Source
DOJ Data Set 9
Reference
efta-efta00281085
Pages
12
Persons
0
Integrity
Extracted Text (OCR)
Text extracted via OCR from the original document. May contain errors from the scanning process.
20190708 153423.378 I (ProcessorBase.cpp:105]: System:
20190708 153423.378 I (ProcessorBase.cpp:131): CPU: AMD64 12 processors 64bit
RAM: 51537072128
Granularity: 65536
Pagesize: 4096
20190708 153423.378 I (ProcessorBase.cpp:133]: Environment:
Variables:
AFX43_DMC_TBLPATH=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\base2;C:\
Program Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\base2;C:\Program Files\AccessData\Fo
rensic Toolkit\6.2\bin\XSL-Formatter\base2
AFX43_FONT_CONFIGFILE=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\bin\f
ont.config.xml;C:\Program Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin\font.config.xm
1;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin\font.config.xml
AFX43_HOME=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\bin;C:\Program F
iles\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic Tool
kit\6.2\bin\XSL-Formatter\bin
AFX43_HYPDIC_PATH=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\hyphenati
on;C:\Program Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\hyphenation;C:\Program Files\A
ccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\hyphenation
AFX43_LIC_PATH=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\bin;C:\Progr
am Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic
Toolkit\6.2\bin\XSL-Formatter\bin
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\aespivack\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=WORKSTATION-AES
ComSpec=C:\Windows\system32\cmd.exe
DEFAULT_CA_NR=CA100
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\aespivack
LOCALAPPDATA=C:\Users\aespivack\AppData\Local
LOGONSERVER=\\WORKSTATION-AES
MOZ_PLUGIN_PATH=C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\
NUMBER_OF_PROCESSORS=12
OPENSSL_CONF=C:\Users\AESPIV-1\AppData\Local\Temp\(A48A84F7-BB48-4046-8BCE-40CD742C9BB4)\\open
ssl.cfg
OS=Windows_NT
Path=o:\oracle\product\10.2.0\client_l\bin;O:\Oracle\Product\10.2.0\AccessDataDB\bin;C:\Window
s\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Progra
m Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic T
oolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files (x86)\Common Files\Teleca Shared;C:\Program Files\
nodejs\;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin;C:\Program Files (x86
)\Common Files\Apple\Apple Application Support;C:\Program Files (x86)\Common Files\Apple\Mobile Devi
ce Support;C:\Program Files\Common Files\Apple\Apple Application Support;C:\Program Files\Common Fil
es\Apple\Mobile Device Support;C:\Program Files (x86)\Microsoft SDKs\TypeScript\1.0\;C:\Users\aespiv
ack\AppData\Roaming\npm
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Inte164 Family 6 Model 44 Stepping 2, Genuinelntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=2c02
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=D:\adtemp
TMP=D:\adtemp
USERDOMAIN=Workstation-AES
USERNAME=aespivack
USERPROFILE=C:\Users\aespivack
VBOX_MSI_INSTALL_PATH=C:\Program Files\Oracle\VirtualBox\
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
_COMPAT_LAYER=RunAsAdmin DisableUserCallbackException
Modules:
C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADProcessor.exe
7:12:26 PM T
uesday, April 18, 2017
10.16.1.9
C:\Windows\SYSTEM32\ntdll.dll
6:41:18 AM Thursday, November 17, 2011
6.1.7601.17725
C:\Windows\SYSTEM32\MSCOREE.DLL
3:23:48 AM Sunday, November 21, 2010
4.0.40305.0
C:\Windows\system32\KERNEL32.d11
5:37:12 AM Saturday, July 16, 2011
6.1.7601.17651
EFTA00281085
C:\Windows\system32\KERNELBASE.dll
5:37:12 AM Saturday, July 16, 2011
6.1.7601.17651
C:\Windows\system32\apphelp.dll
3:24:03 AM Sunday, November 21, 2010
6.1.7601.17514
C:\Windows\AppPatch\AppPatch64\AcGenral.DLL
1:40:00 AM Tuesday, July 14, 2009
6.1.7600
.16385
C:\Windows\system32\SspiCli.d11
C:\Windows\system32\msvcrt.d11
C:\Windows\system32\RPCRT4.d11
C:\Windows\system32\SHLWAPI.d11
C:\Windows\system32\GD132.d11
C:\Windows\system32\OSER32.d11
C:\Windows\system32\LPK.d11
1:
C:\Windows\system32\USP10.d11
C:\Windows\system32\ole32.d11
C:\Windows\system32\SHELL32.d11
C:\Windows\system32\sfc.d11
1:
C:\Windows\system32\sfc_os.DLL
C:\Windows\system32\USERENV.d11
C:\Windows\system32\profapi.d11
C:\Windows\system32\dwmapi.d11
C:\Windows\system32\ADVAP132.d11
C:\Windows\SYSTEM32\sechost.d11
C:\Windows\system32\MPR.d11
1:
C:\Windows\system32\IMM32.DLL
C:\Windows\system32\MSCTF.d11
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
12:34:06 AM Friday, November
06, 2015
4.6.1055.0
C:\Windows\system32\VERSION.dll
1:41:56 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
12:34:06 AM Friday, November 06,
2015
4.6.1055.0
C:\Windows\system32\MSVCR120_CLR0400.d11
2:09:00 PM Thursday, October 22, 2015
12.0.52
512.0
C:\Windows\assembly\Nativelmages_v4.0.30319_64\mscorlib\fa8eef6f6cb67c660d71e15c5cad71b5\mscor
lib.ni.dll
3:42:42 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\system32\CRYPTBASE.d11
1:40:24 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\system32\uxtheme.d11
1:41:56 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\system32\CRYPTSP.dll
1:40:24 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\system32\rsaenh.dll
1:43:15 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\system32\RpcRtRemote.d11
3:24:01 AM Sunday, November 21, 2010
6.1.7601.1751
4
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll
12:34:06 AM Friday, November 0
6, 2015
4.6.1055.0
C:\Windows\system32\OLEALIT32.d11
5:37:49 AM Saturday, August 27, 2011
6.1.7601.17676
C:\Windows\assembly\Nativelmages_v4.0.30319_64\System\5f665a4076cb8d9479ca406e7827fb9f\System.
ni.dll
3:42:49 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\assembly\Nativelmages_v4.0.30319_64\System.Drawing\1751687825177cb487c1080d7e37401f
\System.Drawing.ni.dll
4:09:48 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\assembly\Nativelmages_v4.0.30319_64\System.Windows.Forms\a359814ff0333ca2c4ab29f30f
55dd20\System.Windows.Forms.ni.dll
4:09:57 PM Monday, July 02, 2018
4.6.1055.0
C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADLogger.dll
7:10:38 PM Tues
day, April 18, 2017
6.2.0.400
C:\Program Files\AccessData\Evidence Processing Engine\10.16\ad_log.dll
7:10:36 PM Tuesda
y, April 18, 2017
6.2.0.400
C:\Windows\system32\MSVCP140.d11
4:06:54 AM Friday, August 26, 2016
14.0.24215.1
CO,Windows\system32\VCRUNTIME140.d11
4:06:54 AM Friday, August 26, 2016
14.0.24215.1
CO,Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-runtime-11-1-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\ucrtbase.DLL
4:45:24 PM Wedn
esday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-timezone-11-1-0.d
11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
CO,Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-file-12-1-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
CO,Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-localization-11-2
-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-synch-11-2-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
CO,Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-processthreads-11
-1-1.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
CO,Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-file-11-2-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-string-11-1-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
CO,Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-heap-11-1-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
CO,Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-stdio-11-1-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
CO,Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-convert-11-1-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
CO,Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-locale-11-1-0.d11
6:35:26 AM Thursday, November 17, 2011
6.1.7601.17725
8:46:06 AM Friday, December 16, 2011
7.0.7601.17744
3:24:02 AM Sunday, November 21, 2010
6.1.7601.17514
3:24:22 AM Sunday, November 21, 2010
6.1.7601.17514
3:24:03 AM Sunday, November 21, 2010
6.1.7601.17514
3:24:09 AM Sunday, November 21, 2010
6.1.7601.17514
41:19 AM Tuesday, July 14, 2009
6.1.7600.16385
3:24:08 AM Sunday, November 21, 2010
1.626.7601.17514
3:23:48 AM Sunday, November 21, 2010
6.1.7601.17514
5:43:10 AM Saturday, June 09, 2012
6.1.7601.17859
33:06 AM Tuesday, July 14, 2009
6.1.7600.16385
1:41:54 AM Tuesday, July 14, 2009
6.1.7600.16385
3:24:03 AM Sunday, November 21, 2010
6.1.7601.17514
1:41:53 AM Tuesday, July 14, 2009
6.1.7600.16385
1:40:34 AM Tuesday, July 14, 2009
6.1.7600.16385
1:40:01 AM Tuesday, July 14, 2009
6.1.7600.16385
1:41:53 AM Tuesday, July 14, 2009
6.1.7600.16385
41:26 AM Tuesday, July 14, 2009
6.1.7600.16385
1:41:09 AM Tuesday, July 14, 2009
6.1.7600.16385
1:41:28 AM Tuesday, July 14, 2009
6.1.7600.16385
EFTA00281086
11
dll
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-math-11-1-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-multibyte-11-1-0.d
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-time-11-1-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-filesystem-11-1-0.
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-environment-11-1-0
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-utility-11-1-0.d11
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10
7:10:52 PM Tuesday, April 18, 2017
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10
7:10:52 PM Tuesday, April 18, 2017
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10
7:10:52 PM Tuesday, April 18, 2017
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_chrono-vc140-mt-1_59.d11
7:10:48 PM Tuesday, April 18, 2017
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\PLlsupportManaged.dll
7:11:3
6 PM Tuesday, April 18, 2017
10.16.1.9
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll
12:34:06 AM Friday, Novemb
er 06, 2015
4.6.1055.0
C:\Windows\assembly\Nativelmages_v4.0.30319_64\System.Core\5034a88e58f966dd7d69fe9b9875832c\Sy
stem.Core.ni.dll
3:51:31 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\assembly\Nativelmages_v4.0.30319_64\System.Configuration\46ec60579b59cedcc8c39cabca
6d1153\System.Configuration.ni.dll
3:51:33 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\assembly\Nativelmages_v4.0.30319_64\System.Xml\c9576235d85a3db71a0bee45aa4155ba\Sys
tem.Xml.ni.dll
3:51:23 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\system32\ws2_32.d11
3:24:28 AM Sunday, November 21, 2010
6.1.7601.17514
C:\Windows\system32\NSI.dll
1:41:53 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\system32\mswsock.dll
3:24:00 AM Sunday, November 21, 2010
6.1.7601.17514
C:\Windows\System32\wshtcpip.d11
1:41:58 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\System32\wship6.d11
1:41:58 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\system32\NLAapi.dll
3:23:54 AM Sunday, November 21, 2010
6.1.7601.17514
C:\Windows\system32\napinsp.dll
1:41:52 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\system32\pnrpnsp.dll
1:41:53 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\system32\DNSAPI.dll
6:24:15 AM Thursday, March 03, 2011
6.1.7601.17570
C:\Windows\System32\winrnr.d11
1:41:56 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Windows\system32\wshbth.dll
3:24:36 AM Sunday, November 21, 2010
6.1.7601.17514
C:\Windows\assembly\Nativelmages_v4.0.30319_64\System.ServiceModel\ac14548e7a731da59e036d17ba8
e3c06\System.ServiceModel.ni.dll
4:11:13 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\assembly\Nativelmages_v4.0.30319_64\System.Servdldec6261\7a5b7af88001106023a3e276d8
fbe359\System.ServiceModel.Internals.ni.dll
4:10:39 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\assembly\Nativelmages_v4.0.30319_64\SMDiagnostics\c329a07fa3cb821400eb59734c1a04d8\
SMDiagnostics.ni.d11
4:10:02 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa121\ec3ea73175791bdle5d2031d28
31e641\System.Runtime.Serialization.ni.dll
4:10:38 PM Monday, July 02, 2018
4.6.1055.0
C:\Windows\system32\pcwum.DLL
1:41:53 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Program Files\AccessData\Evidence Processing Engine\10.16\PLlsupport.dll
7:11:34 PM Tu
esday, April 18, 2017
10.16.1.9
C:\Program Files\AccessData\Evidence Processing Engine\10.16\Altova.dll
7:10:44 PM Tuesda
y, April 18, 2017
10.16.1.9
C:\Program Files\AccessData\Evidence Processing Engine\10.16\AltovaXML.d11
7:10:46 PM Tue
sday, April 18, 2017
10.16.1.9
C:\Program Files\AccessData\Evidence Processing
36 PM Tuesday, April 18, 2017
10.16.1.9
C:\Program Files\AccessData\Evidence Processing
day, April 18, 2017
10.16.1.9
C:\Program Files\AccessData\Evidence Processing
ursday, August 04, 2016
7.73.8140.1
C:\Program Files\AccessData\Evidence Processing
ay, April 18, 2017
57.1.0.0
C:\Program Files\AccessData\Evidence Processing
ay, April 18, 2017
57.1.0.0
C:\Program Files\AccessData\Evidence Processing
ay, April 18, 2017
57.1.0.0
C:\Program Files\AccessData\Evidence Processing
Tuesday, April 18, 2017
2.0.0.22
C:\Program Files\AccessData\Evidence Processing
1
7:10:52 PM Tuesday, April 18, 2017
2.0.0.22
C:\Program Files\AccessData\Evidence Processing
day, April 18, 2017
6.2.0.1026
C:\Program Files\AccessData\Evidence Processing
esday, April 18, 2017
6.2.0.479
C:\Program Files\AccessData\Evidence Processing
7:10:56 PM Tuesday, April 18, 2017
6.2.0.1026
.dll
Engine\10
Engine\10
Engine\10
Engine\10
Engine\10
Engine\10
Engine\10
Engine\10
Engine\10
Engine\10
Engine\10
.16\boost_date_time-vc140-mt-1_59.d11
.16\boost_thread-vc140-mt-1_59.d11
.16\boost_system-vc140-mt-1_59.d11
.16\processing_options.d11
7:11:
.16\epshared.d11
.16\dtengine64.d11
.16\icuuc57.d11
.16\icudt57.d11
.16\icuin57.d11
.16\adshattrdefs.d11
7:11:06 PM Tues
9:58:02 PM Th
7:11:18 PM Tuesd
7:11:22 PM Tuesd
7:11:16 PM Tuesd
7:12:26 PM
.16\boost_filesystem-vc140-mt-1_59.d1
.16\Database.dll
7:11:00 PM Tues
.16\ad_globals.dll
7:10:34 PM Tu
.16\Database.Definition.Wrapper.d11
EFTA00281087
C:\Program Files\AccessData\Evidence
esday, April 18, 2017
6.2.0.1026
C:\Program Files\AccessData\Evidence
sday, April 18, 2017
6.2.0.1026
C:\Windows\system32\WININET.d11
C:\Windows\system32\Normaliz.d11
C:\Windows\system32\iertutil.d11
50
C:\Windows\system32\urlmon.d11
8:04:24 PM Wednesday,
C:\Program Files\AccessData\Evidence Processing Engine\10
day, April 18, 2017
1.0.1.16
C:\Program Files\AccessData\Evidence Processing Engine\10
4:45:24 PM Wednesday, November 02, 2016
10.0.14393.33
C:\Program Files\AccessData\Evidence Processing Engine\10.16\v2client.d11
day, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing Engine\10.16\socketcomm.d11
esday, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing
day, April 18, 2017
4.1.3.0
C:\Program Files\AccessData\Evidence Processing
ay, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing
day, April 18, 2017
1.0.1.16
C:\Program Files\AccessData\Evidence Processing
7:10:52 PM Tuesday, April 18, 2017
1.0.1.16
C:\Program Files\AccessData\Evidence Processing
Tuesday, April 18, 2017
2016.4.0.1
C:\Program Files\AccessData\Evidence Processing
Tuesday, April 18, 2017
6.2.0.479
C:\Program Files\AccessData\Evidence Processing
Tuesday, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing
M Tuesday, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing
ay, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing
sday, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing
Tuesday, April 18, 2017
6.2.0.473
C:\Windows\system32\PSAPI.DLL
1:41:53 AM Tuesday, July 14, 2009
6.1.7600.16385
C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADIsODLL.d11
7:12:22 PM Tues
day, April 18, 2017
6.2.0.479
C:\Program Files\AccessData\Evidence Processing Engine\10.16\FTEComm.d11
ay, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing Engine\10
Tuesday, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing
ay, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing
day, April 18, 2017
6.2.0.473
C:\Program Files\AccessData\Evidence Processing
ay, April 18, 2017
1.0.0.0
C:\Program Files\AccessData\Evidence Processing
esday, April 18, 2017
1.0.0.0
C:\Windows\system32\mfc140u.d11
4:02:10 AM
C:\Program Files\AccessData\Evidence Processing
2 PM Tuesday, April 18, 2017
6.2.0.1026
C:\Program Files\AccessData\Evidence Processing
7:11:06 PM Tuesday, April 18, 2017
2.0.0.2
C:\Windows\system32\VCOMP140.DLL
4:06:54 AM Friday, August 26, 2016
C:\Windows\system32\ESENT.dll
3:24:00 AM Sunday, November 21, 2010
C:\Program Files\AccessData\Evidence Processing Engine\10.16\summary.d11
ay, April 18, 2017
6.1.7601.17514
C:\Program Files\AccessData\Evidence Processing
day, April 18, 2017
6.1.7601.17514
C:\Program Files\AccessData\Evidence Processing
ay, April 18, 2017
10.16.1.9
C:\Program Files\AccessData\Evidence Processing
Tuesday, April 18, 2017
10.16.1.9
C:\Program Files\AccessData\Evidence Processing
y, April 18, 2017
10.16.1.9
C:\Program Files\AccessData\Evidence Processing
sday, April 18, 2017
10.16.1.9
C:\Program Files\AccessData\Evidence Processing
ay, April 18, 2017
7.45.0.0
C:\Windows\system32\WLDAP32.d11
3:24:07 AM
C:\Program Files\AccessData\Evidence Processing
esday, April 18, 2017
10.16.1.9
0
Processing Engine\10.16\DALWrapper.d11
Processing Engine\10.16\Retrieval.d11
8:04:24 PM Wednesday, September 26, 2012
1:31:40 AM Tuesday, July 14, 2009
6.1.
8:04:24 PM Wednesday, September 26, 2012
7:10:52 PM Tu
7:11:52 PM Tue
9.0.8112.1645
7600.16385
9.0.8112.164
September 26, 2012
9.0.8112.16450
.16\LIBEAY32.d11
7:13:00 PM Tues
.16\api-ms-win-crt-conio-11-1-0.d11
7:11:52 PM Tues
7:11:50 PM Tu
Engine\10.16\fipscomm.dll
7:11:10 PM Sues
Engine\10.16\eshared.dll
7:11:06 PM Tuesd
Engine\10.16\SSLEAY32.d11
7:13:24 PM Tues
Engine\10.16\boost_regex-vc140-mt-1_59.d11
Engine\10.16\adtz_globals.dll
7:10:40 PM
Engine\10.16\adfs_globals.dll
7:10:40 PM
Engine\10.16\agent_globals.dll
7:10:42 PM
Engine\10.16\abstractclient.dll
7:10:40 P
Engine\10.16\agentfs.dll
7:10:42 PM Tuesd
Engine\10.16\ProxyComm.d11
7:11:44 PM Tue
Engine\10.16\filtering_lib.d11
7:11:16 PM
Engine\10.16\Exporter.d11
Engine\10.16\Indexer.d11
7:11:08 PM Tuesd
.16\v2proxyclient.dll
7:11:52 PM
Engine\10.16\eremote.d11
Engine\10.16\netfslib.dll
Engine\10.16\libbfio.d11
Engine\10.16\libvshadow.d11
7:11:06 PM Tuesd
7:11:30 PM Tues
7:11:22 PM Tuesd
7:11:24 PM Tu
Friday, July 22, 2016
14.0.24213.1
Engine\10.16\DataAccessWrapper.d11
7:10:5
Engine\10.16\duplicate_text_analysis.d11
14.0.24215.1
6.1.7601.17514
7:11:50 PM Tuesd
7:11:12 PM Tues
7:11:20 PM Tuesd
Engine\10.16\LiveSearcher.dll
7:11:26 PM
Engine\10.16\Loader.dll
7:11:34 PM Tuesda
Engine\10.16\Processor.dll
7:11:52 PM Tue
Engine\10.16\libcurl.dll
7:11:22 PM Tuesd
Sunday, November 21, 2010
6.1.7601.17514
Engine\10.16\libtextcat.dll
7:11:24 PM Tu
EFTA00281088
20190708 153423.394 I (ProcessorBase.cpp:391):
20190708 153423.394 I (ProcessorBase.cpp:392):
20190708 153423.394 I [ProcessorBase.cpp:393):
20190708 153423.394 I [ProcessorBase.cpp:394):
20190708 153423.394 I (ProcessorBase.cpp:395):
20190708 153423.394 I (ProcessorBase.cpp:396):
20190708 153423.394 I (ProcessorBase.cpp:397):
20190708 153423.394 I (ProcessorBase.cpp:398):
20190708 153423.394 I (ProcessorBase.cpp:399):
20190708 153423.394 I (ProcessorBase.cpp:400):
20190708 153423.394 I (ProcessorBase.cpp:401):
20190708 153423.394 I [ProcessorBase.cpp:402):
20190708 153423.394 I [ProcessorBase.cpp:441):
C:\Program Files\AccessData\Evidence Processing Engine\10.16\entity_extraction.dll
7:11:0
6 PM Tuesday, April 18, 2017
2.0.0.2
C:\Program Files\AccessData\Evidence Processing Engine\10.16\dna-decryption.dll
7:11:02 P
M Tuesday, April 18, 2017
2.0.0.2
C:\Program Files\AccessData\Evidence Processing Engine\10.16\dna-id.dll
7:11:06 PM Tuesda
y, April 18, 2017
2.0.0.2
C:\Program Files\AccessData\Evidence Processing Engine\10.16\PhotoDNA.dll
7:11:34 PM Tues
day, April 18, 2017
4.3.1.2
C:Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595664144ccfldf_1.1.7601.17825_none_2b25308
271ec7765\gdiplus.dll
5:16:47 AM Saturday, April 21, 2012
6.1.7601.17825
C:Windows\system32\CONCRT140.dll
4:06:54 AM Friday, August 26, 2016
14.0.24215.1
C:\Program Files\AccessData\Evidence Processing Engine\10.16\leveldb.dll
7:11:20 PM Tuesd
ay, April 18, 2017
14.0.24215.1
C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_iostreams-vc140-mt-1_59.d11
7:10:52 PM Tuesday, April 18, 2017
14.0.24215.1
C:\Program Files\AccessData\Evidence Processing Engine\10.16\topic_model.d11
7:11:52 PM T
uesday, April 18, 2017
14.0.24215.1
C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADG.nKFFClient10.d11
7:10:40
PM Tuesday, April 18, 2017
14.0.24215.1
C:\Program Files\AccessData\Evidence Processing Engine\10.16\AgentRightsMgt.d11
7:10:44 P
M Tuesday, April 18, 2017
6.2.0.1026
C:Windows\system32\ACTIVEDS.d11
1:40:00 AM Tuesday, July 14, 2009
6.1.7600.16385
C:Windows\system32\adsldpc.d11
1:40:00 AM Tuesday, July 14, 2009
6.1.7600.16385
COMindows\system32\ATL.DLL
1:40:03 AM Tuesday, July 14, 2009
3.5.2284.0
[7964,) CaselD: 40
[7964,) JobiD: 432f5009857c4ca0b21ef84f36f691c1
[7964,) CasePath: Y:\Epstein\FTK\Epstein - DVDs
[7964,) DB system: Postgres
[7964,) DB username: ADG6x2
[7964,) DB integrated security: 0
[7964,) DB host: WORKSTATION-AES
[7964,) DB port: 5432
[7964,) DB sid: ADG
[7964,) FTK username: aespivack
[7964,) Size limit: 104857600
[7964,) Count limit: 300
[7964,) Working list path: D:\adtemp\432f5009857c4ca0
b2lef84f36f69101.0.Processor.WORKSTATION-AES
20190708 153424.658 I (ProcessorBase.cpp:665): ProcessorBase::SetNumThreads(6)
20190708 153425.079 I (ProcessorBase.cpp:787): _workerCount:0 _minQueueLen:8 _queueMultiplier:2 Work
QueueSize:0
20190708 153425.079 I [ProcessorBase.cpp:787): Handles: 433
Threads: 24
Read operations: 80
Read bytes: 525415
Write operations: 8
Write bytes: 1004
Other operations: 4979
Other bytes: 30287
Kernel time: 296 ms
User time: 1575 ms
Page fault count: 200299
Peak working set: 248832000
Working set: 204128256
Peak pagefile usage: 271974400
Pagefile usage: 213053440
Private bytes: 213053440
20190708 153425.250 I (Preprocessing.cpp:112): [7564,ae8c10037054b4b78a58baca8287b1da100) Pre-Proces
sing: Dematerialize Views start
20190708 153425.250 I (Preprocessing.cpp:147): [7564,ae8c10037054b4b78a58baca8287b1da100) Pre-Proces
sing: Dematerialize Views stop: 0
20190708 153425.250 I (Preprocessing.cpp:152): [7564,ae8c10037c54b4b78a58baca8287b1da100) Pre-Proces
sing: Drop Indexes start
20190708 153425.360 I (EvidenceDB_oracle.cpp:14696]: (7564,ae8c10037c54b4b78a58baca8287b1da100) Cann
of obtain exclusive lock on cmn_objects for 5 seconds. Skipping DropBitmaplndexes.
20190708 153425.360 I (Preprocessing.cpp:187): [7564,ae8c10037054b4b78a58baca8287b1da100) Pre-Proces
sing: Drop Indexes stop: 109
20190708 153425.360 I (Preprocessing.cpp:192): [7564,ae8c10037054b4b78a58baca8287b1da100) Pre-Proces
sing: Drop object constraints start
20190708 153425.500 I [Preprocessing.cpp:227): [7564,ae8c10037054b4b78a58baca8287b1da100) Pre-Proces
sing: Drop object constraints stop: 141
20190708 153428.090 I (DataProxy.cpp:272): (7564,c01f0b7dcaff84e88873d9c14cf3f3d2600) DBThreadPool m
ax threads: 12
20190708 153428.090 I (DataProxy.cpp:275): [7564,c01f0b7dcaff84e88873d9c14cf3f3d2600) DBThreadCountB
ulkOperations max threads: 6
20190708 153428.761 I (Processor.cpp:258): [7724,c31b4fd8442df42fbb8866e7fe3a8ff7100) Read 1: 49
Read 2: 0
Update 1: 159
EFTA00281089
Update 2: 0
Retrieval: 115
Processing 1: 0,1,0
Processing 2: 0,0,0
AdditionalItemReporting: 0
KFF Lookup: 0
Carving: 0,0,0
Metacarving: 0,1,0
SlackEnumeration: 0,1,0
Identify: 0,1,0
PostldentifyRefinement: 0,1,0
PhotoDna: 0,0,0
Thumbnail: 0,0,0
Hashing: 0,1,0
Hashing 2: 0,1,0
FBFS Detection: 0,1,0
oleStreamRefinement: 0,1,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,1,0
Parse Email Field: 0,1,0
OCR: 0,0,0
generatedItemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphiCSWF: 0,0,0
generateRedactediext: 0,0,0
languageldentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,1,0
Browser History: 0,1,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153428.854 I (Processor.cpp:258): (7384,c578c3512fd8847d28ac7d22eda74b0fe001 Read 1:
Read 2: 0
Update 1: 35
Update 2: 0
Retrieval: 200
Processing 1: 105,17,6.17647
Processing 2: 0,0,0
AdditionalItemReporting: 0
KFF Lookup: 0
Carving: 0,1,0
Metacarving: 0,17,0
SlackEnumeration: 0,17,0
Identify: 0,17,0
PostldentifyRefinement: 0,17,0
PhotoDna: 0,0,0
Thumbnail: 0,0,0
Hashing: 10,17,0.588235
Hashing 2: 0,17,0
FBFS Detection: 38,17,2.23529
oleStreamRefinement: 0,17,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,17,0
Parse Email Field: 0,17,0
OCR: 0,0,0
generatedltemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
languageldentification: 0,0,0
EFTA00281090
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,17,0
Browser History: 0,17,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153428.870 I (Processor.cpp:258]: (7724,c975d061950024d429a99d98d92d5c4c200] Read 1: 24
Read 2: 0
Update 1: 81
Update 2: 0
Retrieval: 0
Processing 1: 4,1,4
Processing 2: 0,0,0
AdditionalItemReporting: 0
KFF Lookup: 0
Carving: 0,0,0
Metacarving: 0,1,0
SlackEnumeration: 0,1,0
Identify: 0,1,0
PostldentifyRefinement: 0,1,0
PhotoDna: 0,0,0
Thumbnail: 0,0,0
Hashing: 0,1,0
Hashing 2: 0,1,0
FBFS Detection: 1,1,1
olestreamRefinement: 0,1,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,1,0
Parse Email Field: 0,1,0
OCR: 0,0,0
generatedItemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
languageldentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,1,0
Browser History: 0,1,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153432.380 I (Processor.cpp:258]: (7384,c99c786a621124d8394b877c1c7043d5400) Read 1: 27
Read 2: 0
Update 1: 20
Update 2: 0
Retrieval: 0
Processing 1: 3460,4,865
Processing 2: 0,0,0
AdditionalItemReporting: 0
KFF Lookup: 0
Carving: 0,3,0
Metacarving: 0,4,0
SlackEnumeration: 1,4,0.25
Identify: 3270,4,817.5
PostldentifyRefinement: 0,4,0
PhotoDna: 0,0,0
Thumbnail: 0,0,0
Hashing: 143,4,35.75
Hashing 2: 0,4,0
FBFS Detection: 16,4,4
olestreamRefinement: 0,4,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,4,0
Parse Email Field: 0,4,0
OCR: 0,0,0
generatedItemReporting: 0,0,0
clearStream: 0,0,0
EFTA00281091
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
languageIdentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,4,0
Browser History: 0,4,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153432.926 I (Processor.cpp:258): (2176,c5b03d8a123af44d78bdc6ece8cc9857400) Read 1: 41
Read 2: 0
Update 1: 21
Update 2: 0
Retrieval: 115
Processing 1: 4291,4,1072.75
Processing 2: 0,0,0
AdditionalItemReporting: 0
KFF Lookup: 0
Carving: 0,2,0
Metacarving: 0,4,0
SlackEnumeration: 0,4,0
Identify: 3255,4,813.75
PostldentifyRefinement: 0,4,0
PhotoDna: 0,0,0
Thumbnail: 0,0,0
Hashing: 996,4,249
Hashing 2: 0,4,0
FBFS Detection: 30,4,7.5
olestreamRefinement: 0,4,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,4,0
Parse Email Field: 0,4,0
OCR: 0,0,0
generatedItemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
languageIdentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,4,0
Browser History: 0,4,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153432.988 I (Processor.cpp:258): (2176,cd77a2ef5eae545d8ad429c62a1955dc800) Read 1: 23
Read 2: 0
Update 1: 19
Update 2: 0
Retrieval: 0
Processing 1: 12,1,12
Processing 2: 0,0,0
AdditionalItemReporting: 0
KFF Lookup: 0
Carving: 0,0,0
Metacarving: 0,1,0
SlackEnumeration: 0,1,0
Identify: 0,1,0
PostldentifyRefinement: 0,1,0
PhotoDna: 0,0,0
Thumbnail: 0,0,0
Hashing: 0,1,0
Hashing 2: 0,1,0
FBFS Detection: 6,1,6
olestreamRefinement: 0,1,0
EFTA00281092
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,1,0
Parse Email Field: 0,1,0
OCR: 0,0,0
generatedItemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
languageldentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,1,0
Browser History: 0,1,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153438.885 I (Processor.cpp:258): (5044,c77d037efb06448f9a0cb83af71a0bb0e00J Read 1: 240
Read 2: 0
Update 1: 26
Update 2: 0
Retrieval: 86
Processing 1: 10237,4,2559.25
Processing 2: 0,0,0
AdditionalltemReporting: 0
KFF Lookup: 0
Carving: 0,4,0
Metacarving: 0,4,0
SlackEnumeration: 0,4,0
Identify: 3840,4,960
PostIdentifyRefinement: 0,4,0
PhotoDna: 0,0,0
Thumbnail: 0,0,0
Hashing: 6342,4,1585.5
Hashing 2: 0,4,0
FBFS Detection: 35,4,8.75
oleStreamRefinement: 0,4,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,4,0
Parse Email Field: 0,4,0
OCR: 0,0,0
generatedItemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
languageldentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,4,0
Browser History: 0,4,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153455.468 I (Processor.cpp:258): (7384,ca410075d5068463aa38adOaab681c03800) Read 1: 31
Read 2: 0
Update 1: 21
Update 2: 0
Retrieval: 0
Processing 1: 23021,1,23021
Processing 2: 0,0,0
AdditionalltemReporting: 0
KFF Lookup: 0
Carving: 0,1,0
Metacarving: 0,1,0
EFTA00281093
SlackEnumeration: 0,1,0
Identify: 1671,1,1671
PostIdentifyRefinement: 0,1,0
PhotoDna: 0,0,0
Thumbnail: 366,1,366
Hashing: 20979,1,20979
Hashing 2: 0,1,0
FBFS Detection: 0,1,0
oleStreamRefinement: 0,1,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,1,0
Parse Email Field: 0,1,0
OCR: 0,0,0
generatedItemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
languageldentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,1,0
Browser History: 0,1,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153542.081 I (Processor.cpp:258): (7564,c01f0b7dcaff84e88873d9c14cf3f3d2600) Read 1: 94
Read 2: 0
Update 1: 105
Update 2: 0
Retrieval: 133
Processing 1: 73371,1,73371
Processing 2: 0,0,0
AdditionalltemReporting: 0
KFF Lookup: 0
Carving: 0,1,0
Metacarving: 0,1,0
SlackEnumeration: 0,1,0
Identify: 2087,1,2087
PostldentifyRefinement: 0,1,0
PhotoDna: 0,0,0
Thumbnail: 243,1,243
Hashing: 71026,1,71026
Hashing 2: 0,1,0
FBFS Detection: 12,1,12
oleStreamRefinement: 0,1,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,1,0
Parse Email Field: 0,1,0
OCR: 0,0,0
generatedltemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
languageldentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,1,0
Browser History: 0,1,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153544.842 I (Processor.cpp:258): (6364,c050745f4bfc94007a4458b2244b462e200) Read 1: 23
Read 2: 0
EFTA00281094
Update 1: 20
Update 2: 0
Retrieval: 15
Processing 1: 76220,1,76220
Processing 2: 0,0,0
AdditionalItemReporting: 0
KFF Lookup: 0
Carving: 0,1,0
Metacarving: 0,1,0
SlackEnumeration: 0,1,0
Identify: 1837,1,1837
PostldentifyRefinement: 0,1,0
PhotoDna: 0,0,0
Thumbnail: 233,1,233
Hashing: 74125,1,74125
Hashing 2: 0,1,0
FBFS Detection: 20,1,20
oleStreamRefinement: 0,1,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,1,0
Parse Email Field: 0,1,0
OCR: 0,0,0
generatedItemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
languageldentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,1,0
Browser History: 0,1,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153546.745 I (Processor.cpp:258]: (7724,c9adb3ae9laab47889f8b56df54c314cf00] Read 1: 27
Read 2: 0
Update 1: 20
Update 2: 0
Retrieval: 0
Processing 1: 77819,1,77819
Processing 2: 0,0,0
AdditionalitemReporting: 0
KFF Lookup: 0
Carving: 0,0,0
Metacarving: 0,1,0
SlackEnumeration: 0,1,0
Identify: 4800,1,4800
PostIdentifyRefinement: 0,1,0
PhotoDna: 0,0,0
Thumbnail: 233,1,233
Hashing: 72780,1,72780
Hashing 2: 0,1,0
FBFS Detection: 0,1,0
oleStreamRefinement: 0,1,0
storeKeyFiles: 0,1,0
createPDFs: 0,0,0
createHTML: 0,0,0
ctpLookup: 0,0,0
LTU Porn Scoring: 0,1,0
Parse Email Field: 0,1,0
OCR: 0,0,0
generateditemReporting: 0,0,0
clearStream: 0,0,0
saveNativeStream: 0,0,0
saveEmailBody: 0,0,0
generateMSG: 0,0,0
generateCoolHTMLRTF: 0,0,0
generateNativeSWF: 0,0,0
generateGraphic: 0,0,0
generateGraphicSWF: 0,0,0
generateRedactediext: 0,0,0
EFTA00281095
languageldentification: 0,0,0
duplicate_text_feature_extraction: 0,0,0
Jaml: 0,1,0
Browser History: 0,1,0
EntityExtraction: 0,0,0
scrapeEmailSignatures: 0,0,0
20190708 153549.600 I (ProcessorBase.cpp:665): ProcessorBase::SetNumThreads(0)
20190708 153550.037 I logger processor (7768) thread cpu accrued time: 0:00:00.015600 (15600 microse
cs). Wall clock transpired time: 0:01:27.032552 (87032552 microsecs).
20190708 153550.037 I total of above threads' cpu accrued times: 0:00:00.015600 (15600 microsecs).
20190708 153550.037: process 5204 cpu accrued time: 0:00:14.180490 (14180490 microsecs). Wall clock
transpired time: 0:01:27.750154 (87750154 microsecs).
EFTA00281096
Technical Artifacts (14)
View in Artifacts BrowserEmail addresses, URLs, phone numbers, and other technical indicators extracted from this document.
Domain
microsoft.netIPv4
57.1.0.0IPv4
7.45.0.0Phone
1.626.7601Phone
13053440Phone
14180490Phone
4128256Phone
4857600Phone
601.1751Phone
7032552Phone
7072128Phone
7750154Phone
8832000Phone
9857400Related Documents (6)
DOJ Data Set 10OtherUnknown
EFTA01294870
10p
Dept. of JusticeOtherUnknown
EFTA Document EFTA01277005
*UBS IRS Financial Services tic. Private Wealth Management 299 Park Avenue 26th Floor New York NY 10171.0002 ANP70036969670219 • 0 Account name: MAX FOUNDATION Friendly account name: MAX FOUNDATION Account number. Your linens:WI Advisor- SCOTT STACKMANitYLE CASK EL Questions about your statement? call y0ur fir-Jan:re' AdvJiOr Of ti e Resourcetine at account VIsItour webs's.: www.ubitOnYlinanCiakerviCeS Items for your attention Help protect ycJitelf lion, liaw and review bank,
56p
DOJ Data Set 9OtherUnknown
Memorandum
Memorandum Subject Re: Operation Leap Year Date May 1, 2007 (Revised 9/13/07) (2nd Revision 2/19/08)' To From R. Alexander Acosta, United States Attorney First Assistant United States Attorney Chief, Criminal Division MAUSA, Northern Region , Chief, Northern Region I. Introduction This memorandum seeks approval for the attached indictment char in Jeffrey Epstein, Min a/k/a' JEGE Inc., and Hyperion Air, Inc. The proposed indictment contains 60 counts and seeks the forfeiture of Epstein's Palm Beach home and two airplanes? The FBI has information regarding Epstein's whereabouts on May 16th and May 19th and they would like to arrest him on one of those dates. Epstein is considered an extremely high flight risk' and, from information we have received, a continued danger 'The second revision amends the Jane Doe numbering system to correspond with the most recent indictment. It also removes the references to the overt acts and substantive allegations related to each
53p
DOJ Data Set 9OtherUnknown
DS9 Document EFTA00298259
34p
Court UnsealedTestimonyUnknown
court transcript: A-5918
The document is a court transcript where MS. DAVIS argues that Mr. Parse's attorney made strategic choices that benefited him, and that MR. SHECHTMAN has not met the Strickland standard for ineffective assistance of counsel. The court had previously ruled on a motion for a new trial related to Catherine Conrad, a juror who was known to the defendant's law firm, Brune & Richard.
1p
Dept. of JusticeOtherUnknown
EFTA Document EFTA01299130
KYC Print Page 1 of' 19 DB PWM GLOBAL KYC/NCA: PART A Int KYC Case # : 01141308 One sheet must be established per relationship - list all accounts included in the relationship 1. Relationship Details Relationship Name: EPSTEIN, JEFFREY RELATIONSHIP:00000483290 Booking Center: New York Relationship Manager: Paul Moms Relationship to PWM: 17 New PWM Relationship F Existing PWM Relationship If existing, please indicate since when the relationship exists, provide reason for new profi
19p
Forum Discussions
This document was digitized, indexed, and cross-referenced with 1,500+ persons in the Epstein files. 100% free, ad-free, and independent.
Annotations powered by Hypothesis. Select any text on this page to annotate or highlight it.