EFTA Document EFTA01683655

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) UNSUB; JEFFREY EPSTEIN — VICTIM; DEATH INVESTIGATION Digital Evidence Tracking (U//FOUO) Executive Summary: The New York Division (NY) initiated a death investigation for the apparent suicide of Jeffrey EPSTEIN at the Metropolitan Correctional Center (MCC) which occurred on 10 August 2019. On 12 August 2019, OTD was contacted by the NY Division for assistance with a MCC video surveillance system consisting of two Digital Video Recorders (DVR1 - operational and DVR2 — not operational) and a controller. The NY Division Computer Analysis Response Team (NY CART) has collected digital evidence items associated with this investigation. OTD is currently tracking 43 digital evidence items (associated with DVR1 and DVR2): (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Location Status Challenges Lawful Access Time in Process HQQ019599 — Hard Drive — Seagate Barracuda S00GB HDD, STSOODM002, S/N Z3T6CJJA (DVR2 —1 of 18) NYCO23578 181 OTD - ECU COMPLETE 8/22/2019 - Confirmed clone 1822 (H4C1019619). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 UNCLASSIFIED//FOUO EFTA01683655 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 19 Physical Location Status Challenges Lawful Access Time in Process HQQ0196O0 - Hard Drive — Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36A13K (DVR2 — 2 of 18) NYC023579 162 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1823 (HQQ019620). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 HQQ019601 — Hard Drive — Seagate Barracuda 500GB HDD, STS00DM002, S/N Z3T6CFSX (DVR2 — 3 of 18) NYC023580 163 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1824 (HQQ019621). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 UNCLASSIFIED//FOUO EFTA01683656 UNCLASSIFIED//FOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 19 Physical Location Status Challenges Lawful Access Time in Process HQQ019602 — Hard Drive — Seagate Barracuda 500GB HDD, ST350032ONS, S/N 9QM8MT9P (DVR2 4 of 18) NYCO23581 1B4 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1B25 (HQQ019622). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 HQQ019603 — Hard Drive — Hitachi 500GB HDD, HDS721050CLA662, S/N: JP15721E36MWNK (DVR2 - 5 of 18) NYCO23582 185 OTD - DFAU 8/22/2019 — Data recovery 33% completed. Not likely to be completed before 8/26/2019. 8/21/2019 — Repaired, data is being recovered - 26% complete. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. Pending delivery of donor parts for repair. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged N/A Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA01683657 UNCLASSIFIED//FOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 18 Physical Location Status Challenges Lawful Access Time in Process HQQ019604 — Hard Drive — Seagate Barracuda 500GB HDD, ST350032ONS, S/N 9QM8EC75 (DVR2 - 6 of 18) NYCO23583 1B6 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1826 (HQQ019623). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 HQQ019605 — Hard Drive — Seagate Constellation ES 500GB HDD, STSOONMO011, S/N Z1M1PZPE (DVR2 — 7 of 18) NYCO23584 1B7 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1827 (HQC1019624). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 UNCLASSIFIED//FOUO EFTA01683658 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Location Status Challenges Lawful Access Time in Process HQQ019606 — Hard Drive - Western Digital 500GB HDD, WD5000AVDS- 63U7B1, S/N WCAV9Z911026 (DVR2 - 8 of 18) NYC023585 188 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1828 (HQQ019625). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 HQQ019607 — Hard Drive - Western Digital 500GB HOD, WD5000AAKX- 60U6AA0, S/N WCC2EJUC34CJ (DVR2 —9 of 18) NYC023586 1B9 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1829 (HQQ019626). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 UNCLASSIFIED//FOUO EFTA01683659 UNCLASSIFIEDHFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 18 Physical Location Status Challenges Lawful Access Time in Process HQQ019608 — Hard Drive - Seagate Barracuda 500GB HDD, ST350032ONS, S/N 9QM8MSEZ (DVR2 - 10 of 18) NYCO23587 1B10 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1830 (HQQ019627). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 HQQ019611 — Hard Drive - Seagate Constellation ES 500GB HDD, ST5OONM0011, S/N Z1M1PX26 (DVR2 — 11 of 18) NYCO23588 1811 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1831 (H00019628). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 UNCLASSIFIED//FOUO EFTA01683660 UNCLASSIFIEDRFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Location Status Challenges Lawful Access Time in Process HQQ019612 — Hard Drive - Seagate Constellation ES 500GB HDD, STSOONM0011, S/N Z1M1Q1FX (DVR2 —12 of 18) NYCO23589 1B12 OTD - DFAU COMPLETE 8/22/2019 — Confirmed clone 1832 (H00019629). Forensic Image on NYO Op Wan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 HQQ019613 — Hard Drive - Western Digital 500GB HDD, WD5000AVDS- 63U7B1, S/N WCAV9T870016 (DVR2 - 13 of 18) NYCO23590 1B13 OTD - DFAU COMPLETE 8/22/2019 — 100% acquired. Forensic Image made to DFAU OpWan. Clone being created and turned over to Examiner. 8/19/2019 — Damaged heads. DFAU performed head stack swap, data is slowly imaging. 97% complete. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged N/A Started: 8/16/2019 Completed: 8/22/2019 UNCLASSIFIED//FOUO EFTA01683661 UNCLASSIFIED//FOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 16 Physical Location Status Challenges Lawful Access Time in Process HQQ019614 —Hard Drive - Western Digital 500GB HDD, WD5000AAKX- 60U6AAO, S/N WCC2E0DE83YK (DVR2 - 14 of 18) NYCO23591 1B14 OTD - DFAU COMPLETE 8/22/2019 — Imaged to DFAU OpWan. Clone created (HQQ) and turned over examiner. 8/21/2019 — Repairs Completed, data recovered, multiple bad sectors. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. Pending delivery of donor parts for repair. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged N/A Started: 8/16/2019 Completed: 8/22/2019 H00019615 — Hard Drive - Seagate Barracuda 500GB HDD, ST350032ONS, S/N 9QM8MT6D (DVR2 — 15 of 18) NYCO23592 IBIS OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1833 (HQQ019630). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 UNCLASSIFIED//FOUO EFTA01683662 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 16 Physical Location Status Challenges Lawful Access Time in Process HQQ019616 — Hard Drive - Seagate Constellation ES 500GB HDD, STSOONM0011, S/N Z1M1PZ07 (DVR2 —16 of 18) NYCO23593 1B16 OTD - ECU COMPLETE 8/22/2019 — Confirmed clone 1834 (HQQ019631). Forensic Image on NYO OpWan. No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 Completed: 8/22/2019 HQQ019617 — Hard Drive - Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1LOYG (DVR2 — 17 of 18) NYCO23594, Former Bay 9 Drive 1B17 OTD - DFAU COMPLETE 8/22/2019 — Forensic Image completed to DFAU OpWan. Clone created (H00019354) and turned over to examiner. 8/19/2019 — DFAU reports 100% data recovery, device is currently imaging. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged N/A Started: 8/16/2019 Completed: 8/22/2019 UNCLASSIFIED//FOUO EFTA01683663 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Location Status Challenges Lawful Access Time in Process HQQ019618 — Hard Drive - Seagate Barracuda 500GB HDD, ST350032ONS, S/N 9QM8MSRR (DVR2 - 18 of 18) NYCO23595, Former Bay 14 Drive 1B18 OTD - DFAU COMPLETE 8/22/2019 — Forensic Image Completed to DFAU OpWan. Clone created(HQQ019355) and turned over to examiner. 8/19/2019 — DFAU reports partial data recovery (44 bad sectors not recovered), device is imaging. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged N/A S/tarted: 8/16/2019 Completed: 8/22/2019 HQQ019595 — Disk Array Chassis; Nice Systems Model#: SA-66405, SN: F96168201-004 (DVR2) 1B19 OTD - DFAU 8/16/2019 — Chassis for inoperable DVR2 arrived at OTD. Drives removed prior to arrival at OTD N/A N/A Started: 8/16/2019 HQQ019596 - Disk Array Controller; NICE Systems Model#: NP-2000, SN: 43144902 (DVR2) 1619 OTD - DFAU 8/16/2019 — Controller for inoperable DVR2 arrived at OTD. Contains 2 Drives N/A N/A Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA01683664 UNCLASSIFIED//FOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Location Status Challenges Lawful Access Time in Process HQQ019331 — Hard Drive — Seagate Model#: ST3320620AV, SN: 9QFCN325, 320GB (Top Drive of HQQ019596 - Disk Array Controller) 1B19 OTD - ECU COMPLETE 8/22/2019 - No further processing required. Item returned to OTD ECU pending shipment back to NYO. 8/19/2019 — Clone created (HQQ019332) and imaged to DFAU OpWan. 8/16/2019 — Top Hard drive for HQQ019596 - Disk Array Controller arrived at OTD N/A N/A Started: 8/16/2019 Completed: 8/22/2019 HQQ019332 — Hard Drive - Western Digital, 320GB, Model#: WD3200JB, SN: WCAMR1020769 none OTD — DFAU 08/21/2019 — Created by examiner for use in disk array. N/A N/A Started: 8/21/2019 H00019594 — DVR Controller - Dell PowerEdge R420 DVR Controller, Barcode# SBMQZ12, Express service Code #: 11587249622, Manufacturer date: 20140829 (DVR1) 1B20 OTD - DFAU 8/22/2019 - Contains 2 drives Bay 1(HQQ) and Bay 2(HQQ). Drives Imaged to DFAU OpWan and clones created (HQQ) 8/16/2019 — DVR controller for operable DVR1 arrived at OTD. TBD TBD Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA01683665 UNCLASSIFIEDHFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 16 Physical Location Status Challenges Lawful Access Time in Process HQQ019597 — DVR System - Disk Array Chassis containing 16 hard Drives; Model#: Premium 8600, SN: 232476 1B21 OTD - DFAU 8/22/2019 — Drives being labeled with HQQ identifiers, imaged and cloned. 8/16/2019 — Operable DVR1 system arrived at OTD. 16 Drives TBD N/A Started: 8/16/2019 HQQ019598 - Disk Array Controller; Model#: NP- 2000, SN: 43144901 (DVR1) 1621 OTD - DFAU 8/16/2019 — Operable DVR1 system arrived at OTD. Contains 2 drives: 1 damaged, 1 functional. Drives given HQQ identifiers, imaged and cloned. TBD N/A Started: 8/16/2019 HQQ0I8525 — Hard drive — Maxtor DiamondMax 10, 80GB, Model#: 6L080P0, SN: L25C8D3G, Top Drive 1B21 OTD — DFAU COMPLETE 8/22/2019 — Drive imaged and Cloned(HQQ) and Clone turned over to examiner. 8/21/2019 — Damaged hard drive repaired, data is being recovered (10 bad sectors). 8/16/2019 — Arrived at OTD as part of 1621. Top Drive (1 of 2) Damaged N/A Started: 8/16/2019 Completed: 8/22/2019 HQQ018526 — Hard Drive - Maxtor DiamondMax 10, 80GB, Model#: 6L080P0, SN: L25CF5QG, Bottom Drive 1621 OTD - DFAU 8/16/2019 — Arrived at OTD as part of 1621. Bottom Drive (2 of 2) N/A N/A Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA01683666 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Location Status Challenges Lawful Access Time in Process 1622 —1836 — Derivative Evidence —14 Hard Drives containing clone copies of multiple Hard Drives from DVR2. 1B22 OTD - DFAU 8/21/2019 — Arrived at QT on 8/20, in process with DFAU. 8/20/2019 — Drives delivered to OTD. 8/19/2019 — Derivative evidence — clone copies of hard drives removed from DVR2. Collected by DFAU UC Petronella to be delivered to OTD on 8/20/2019 N/A N/A Started: 8/20/2019 1B40 — Hard Drive - One (1) Seagate 500GB hard drive, serial number W2AEXS1V, containing video downloaded from DVR1 at MCC 1B40 NY CART COMPLETE 8/22/2019 — Item not at OTD. Nothing further to report. 8/19/2019 — Copy of all video available for download for 8/10/2019, All relevant video from Special Housing Unit floor 9 and Attorney Visit area floor 3 from 7/23 to 8/10/2019, All video available to download for 8/9 (THIS DOWNLOAD FAILED) and video downloaded by tech, (that is the wrong camera). N/A N/A N/A UNCLASSIFIED//FOUO EFTA01683667