COMPLETE DIGITAL DEVICE FORENSICS ANALYSIS
Jeffrey Epstein DOJ Files -- Comprehensive Device, Evidence & Chain-of-Custody Report
Date: 2026-02-07
Databases searched: primary document text database, Dataset 10 document text database, OCR text extraction database, image catalog database
Total unique EFTA documents analyzed: 150+
Search terms: Cellebrite, EnCase, XRY, FTK, Blacklight, BERLA, forensic exam, CART, chain of custody, hard drive, iPhone, iPad, MacBook, encryption, seized device, CAIR, Relativity, digital evidence, DVR, NiceVision, server, data recovery
EXECUTIVE SUMMARY
The Epstein DOJ files reveal a forensic evidence operation of significant scope -- and significant processing dysfunction. Between July 2019 and late 2021, the FBI seized over 70 digital devices from Epstein's New York mansion (approximately 40 storage devices plus 60+ CDs) and his US Virgin Islands properties (25+ devices including multiple servers and server racks). The processing of this evidence was plagued by:
- 17+ months of delays between seizure and usable production to prosecutors
- Terabytes of data spanning phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers
- Encrypted devices that required specialized cracking
- Server hard drives that physically failed, requiring FBI HQ data recovery specialists
- 71,000+ zero-byte (empty) files in initial productions
- No standardized tracking system -- prosecutors could not match folders to devices
- Catastrophic DVR failures at MCC that destroyed surveillance footage from the night of Epstein's death
- A 2005 Palm Beach computer forensic image on 16 DVDs that was never searched due to lack of legal authority
- 2,100 nude/partially nude images from devices designated "Highly Confidential"
- The FBI CART examiner was reduced to 1 day per week during COVID, stretching timelines by "a factor of 5"
- Evidence review still ongoing as of April 2025 -- 6 years after seizure
March-July 2025 FBI Evidence Review (DS9 expansion): Internal communications between Director Patel, DD Bongino, AUSAs, and FBI NY provide definitive FBI conclusions:
- No sexual abuse videos found -- ever (EFTA00164742): AUSA Comey explicitly stated to Director Patel and DD Bongino: "there were no videos of any sexual abuse identified at any point in the investigation."
- Over 1 million images/videos extracted from devices (EFTA00164897, EFTA00161426): ~34,000 marked responsive (85 GB), 15-20 CSAM images (commercial, not self-produced), ~90% adult pornography/erotica, ~9% generic images
- Camera-in-clock practice documented to 2003 (EFTA00157526): Palm Beach PD burglary report -- 2 years before the 2005 sex trafficking investigation
- MCC surveillance: 147 cameras, 8.08 TB (EFTA00164855): SHU cameras not active at time of death
- Epstein received an unmonitored phone call the night before his death (EFTA00061927): Recipient never identified
PART I: COMPLETE SEIZED DEVICE INVENTORY
EFTA00038465 -- CART EVIDENCE (Jeffrey Epstein), Case 50D-NY-3027571">Source: EFTA00038465 -- CART EVIDENCE (Jeffrey Epstein), Case 50D-NY-3027571
This is the master evidence log. Devices are catalogued by "1B" item numbers:
A. NEW YORK MANSION SEIZURE (July 6, 2019 search warrant)
Desktop Computers:
| --------- | ------------- | ------- |
| 1B28 | Silver Apple Desktop Computer with keyboard and mouse | |
| 1B42 | Cube 9000 Siteserver (BLACK/SILVER) | |
| 1B53 | Apple Desktop Computer with keyboard and mouse | |
| 1B54 | Apple Desktop Computer with keyboard and mouse | |
| 1B57 | Gray Apple Desktop Computer with keyboard and mouse | |
| 1B59 | MSI PC computer in a brown box | |
| 1B61 | Dell Precision Tower 5810 | |
| 1B70 | Apple Desktop Computer | |
Laptops:
| --------- | ------------- | ------- |
| 1B62 | Sony Vaio Laptop | NYCO24336/24337 per search warrant |
| 1B96 | Toshiba Laptop with charger | |
| 1B97 | HP laptop with charger, S/N CND81368V5 | |
Phones & Tablets:
| --------- | ------------- | ------- |
| 1B55 | White Apple iPhone 5 (in cellophane) | |
| 1B67 | Space Gray Apple iPad | |
| 1B68 | Space Gray Apple iPad | |
| 1B71 | Black iPhone, IMEI 357201093322785 | NYCO24318; This is the critical Epstein iPhone |
| 1B72 | Silver iPad, S/N DLXQGM3KGMW3 | |
Hard Drives & Storage:
| --------- | ------------- | ------- |
| 1B29-1B37 | 9x Seagate Path/100 Hard Drives | |
| 1B38-1B39 | 2x Data Traveler 4GB USB (in cellophane) | |
| 1B40 | Mentor Media 32GB USB (in cellophane) | |
| 1B44 | Silicone Power Micro SD Adapter with 16GB SD Card | |
| 1B48-1B51 | 4x Cruzer Guide 32GB USB | NYCO24344-47 |
| 1B52 | SPIEF 2014 Silver USB | |
| 1B56 | Seagate Backup Plus Portable Drive - 1TB | |
| 1B60 | Seagate Barracuda 7200 hard drive 80GB | |
| 1B73-1B74 | 2x Black Hard Drive | |
Optical Media:
| --------- | ------------- | ------- |
| 1B75 | Two Blue Binders with 58 Discs inside | |
| 1B78 | 4 binders with 68 discs inside | |
Recording Devices:
| --------- | ------------- | ------- |
| 1B65 | Silver Olympus Recorder | |
| 1B66 | Black Radio Shack Recorder | |
Cameras:
| --------- | ------------- | ------- |
| 1B58 | Sony Camera with black case | |
B. USVI / LITTLE ST. JAMES ISLAND SEIZURE (August 2019 search warrant)
Desktop Computers:
| --------- | ------------- | ------- |
| 1B80 | Mac Desktop labeled "Kitchen Mac" - grey | First USVI device produced |
| 1B85 | Silver Mac Desktop with mouse/keyboard, S/N CO2NM1MOFY14 | |
| 1B98 | Silver Desktop Mac with Keyboard | |
| 1B102 | Silver MacBook Desktop with keyboard | |
| 1B107 | Silver Mac desktop, Model A1312, S/N W804736DDAS | |
| 1B21 | Mac Desktop, S/N W89524CZPJ, Model A1312 | |
Laptops:
| --------- | ------------- | ------- |
| 1B81 | Silver Mac Laptop labeled "JE BIG LAPTOP" in black bag | "Black Bag" brand |
| 1B82 | Silver MacBook Pro, S/N CO2ZAMOGUQWOP | |
Tablets:
| --------- | ------------- | ------- |
| 1B83 | Silver iPad Model A1567, S/N DMPQL25NGSYPY | |
| 1B84 | Silver iPad Model A1567, S/N DMPQLIRMGSY, in case | |
Other Apple:
| --------- | ------------- | ------- |
| 1B103 | Apple iPod Shuffle on watch band | |
Servers & Networking:
| --------- | ------------- | ------- |
| 1B15 | HP Server with 4x 500GB drives, S/N MXQ3220187 | |
| 1B16 | Panasonic KX-TDE100, S/N KX-TDA0149LCCD005398 | Telecom system |
| 1B17 | 6 Bay with 146GB drives, S/N MXQ824A1R | |
| 1B109 | Unifi Cloud Key, M/N UN-CK | |
| 1B111 | Unifi Video NVR, M/N UVC-NVR-278 | Network video recorder |
Windows PCs:
| --------- | ------------- | ------- |
| 1B19 | HP Desktop Tower, S/N CNV7160050, Model 260-010 | |
| 1B20 | HP Tower, S/N CNV716004Y, Model 260-2010 | |
| 1B22 | Lenovo Tower, S/N MIO7YG6U | |
| 1B23 | Lenovo Tower, S/N 153306G2UMJXEKGX | |
| 1B24 | HP Tower, S/N CNV742213M3, Model 570-p056 | |
Voice Recorder:
| --------- | ------------- | ------- |
| 1B108 | Olympus Digital Voice Recorder | |
C. DEVICES SEIZED FROM EPSTEIN'S PERSON (July 6, 2019 arrest)
Per EFTA00015561 and EFTA00028481:
- 1 iPhone (seized upon arrest at Teterboro Airport) -- Draft search warrant for "JE phone & iPad"
- 1 iPad (seized upon arrest)
D. NYC CART NUMBER CROSS-REFERENCE
From the evidence tracking emails (EFTA00022331, EFTA00020213, EFTA00032065):
| NYCO Number | Device Type | Serial / Identifier |
| ------------- | ------------- | --------------------- |
| NYCO24318 | iPhone (1B71) | IMEI 357201093322785 |
| NYCO24323 | Dell PowerEdge 1310 hard drive #1 | |
| NYCO24324 | Dell PowerEdge 1310 hard drive #2 | |
| NYCO24328 | [Additional device, added late] | |
| NYCO24336 | Sony Vaio laptop / Fujitsu HDD #1 | |
| NYCO24337 | Sony Vaio laptop / Fujitsu HDD #2 | |
| NYCO24340 | Flash Drive (generic) | |
| NYCO24341 | Thumbdrive (Emtec) | |
| NYCO24342 | Hard drive (loose) | Empty -- no images/videos extracted |
| NYCO24343 | Verbatim thumbdrive | |
| NYCO24344-47 | 4x SanDisk Cruzer thumbdrives | |
| NYCO24348-50 | 3x Seagate IDE hard drives | |
| NYCO24353-54 | [Storage devices] | |
| NYCO24362 | [Major device - 600,000+ items] | |
| NYCO24365-72 | [Multiple devices] | |
| NYCO24376-380 | [Drives still being processed as of July 2020] | |
| NYCO24385,387,389,391,393 | Desktop towers (held actual drives) | Not separately tracked |
| NYCO24395 | [Server drives -- multiple] | |
| NYCO27910 | [Added late -- row 96] | |
| NYCO27913 | [Listed as provided 7/23 but missing from disc] | |
Total estimated NYCO-numbered items: 70-80+
EFTA00029601 -- FBI Forensic Examiner Curriculum Vitae (5 pages)">Source: EFTA00029601 -- FBI Forensic Examiner Curriculum Vitae (5 pages)
The lead FBI examiner was based at the FBI Computer Analysis Response Team (CART), 26 Federal Plaza, New York, NY 10278. This individual held the following forensic certifications and training relevant to the Epstein case:
Forensic Software Tools:
| Tool | Certification / Training | Date |
| ------ | -------------------------- | ------ |
| Cellebrite / Secureview | Cell Phone Forensics training (4 days, Salt Lake City) | Feb 2009 |
| Cellebrite | Certified Operator & Certified Physical Analyst (5 days, Austin TX) | March 2018 |
| XRY | Mobile Phone Examination (2 days, Kansas City) | May 2009 |
| EnCase | Internet Processing (3 days, Chicago); EnCase Certification | March 2010 / Feb 2008 |
| FTK (Forensic Tool Kit) | Boot Camp (3 days); FTK 3 (3 days, Dallas); Advanced FTK Lab (3 days); FTK III for Mac (3 days, San Diego) | 2005-2012 |
| Blacklight | Mac forensics (2 days, NYPD Academy, NY) | May 2014 |
| BlackBag / Macintosh Forensics | Forward Discovery (5 days); Black Bag Mac Forensics (5 days, San Diego) | April 2009 / April 2018 |
| BERLA | Vehicle Forensics (5 days, Annapolis) | March 2019 |
| IACIS | Windows Forensic Examiner (4 days, Orlando) | May 2016 |
| Linux forensics | Virtual Forensics for Linux (5 days, Denver); Linux Command Line (3 days) | March 2010 / June 2011 |
| Live Capture | (3 days, Baltimore) | August 2010 |
Examiner Qualifications:
- FBI CART Basic Wintel Forensic Examiner (Oct 2006)
- PDA/Cell Phone Forensic Examiner (Dec 2007)
- EnCase Certification (Feb 2008)
- Macintosh Forensic Examiner (April 2009)
- Senior Forensic Examiner (Aug 2010)
- Over 1,000 pieces of computer media analyzed across 300+ cases since 2005
- 200+ search warrants / search and seizure operations participated in
- Expert testimony in SDNY and EDNY Federal Court
- Masters in Digital Forensics and Cyber Security, John Jay College (2015-2019)
Additional Tools Used (referenced in documents):
- Relativity -- e-Discovery platform for evidence review (not a forensic tool)
- CAIR -- FBI evidence access/tracking system
- ImageScan -- FBI image review tool (examiner was instructor)
- DExT -- Digital Evidence eXploitation Toolkit (examiner was instructor)
Cellebrite Usage in the Epstein Case:
Per EFTA00020322 and EFTA00015786:
- Cellebrite was required to view images/videos seized from Apple devices
- Cellebrite software was provided on the review hard drive for defense counsel
- Images from Apple devices could not be viewed as thumbnails; required Cellebrite
- The prison computer (MDC) was incapable of running Cellebrite (per EFTA00021015), meaning Maxwell could not review Apple device evidence on weekends/holidays
PART III: WHAT WAS FOUND ON THE DEVICES
A. Nude / Partially Nude Images (Highly Confidential)
Per EFTA00015738, EFTA00015786, EFTA00020322, EFTA00030035:
Three categories of images designated "Highly Confidential":
~2,100 electronic images and videos seized from Epstein's electronic devices
- Never previously provided to defense until March 2021
- Separated by folder to indicate which device each image was seized from
- For "carved or deleted" images, no metadata was recovered
- Viewable only via Cellebrite for Apple device images
~3,400 electronic images from discs seized from Epstein's residences in 2019
- Previously provided for review at MDC
~7 hard copy nude images from FBI Florida Office investigation file
- Never previously provided to defense
Key restriction: Because these images were classified as "obscene material," the FBI was
not permitted to make duplicates. Only a single clean laptop was available for defense review at 500 Pearl Street.
B. Emails and Documents
Per EFTA00009802 and EFTA00016425:
- Over 1.1 million documents received in initial productions
- Emails and attachments were not linked in initial production (major failure)
- Load files had no link to native files
- Control numbers did not match native files
- Many files were too large to open in the Relativity viewer
- CDs from NY contained pictures only, no documents
- "Terabytes worth of data" across all devices
C. Epstein iPhone NYCO24318 (1B71)
Per EFTA00030562, EFTA00029975:
- The black iPhone (IMEI 357201093322785) was produced as part of the Sixth Production in November 2020
- Final report with images was prepared for production
- This was the phone seized from Epstein upon arrest at Teterboro Airport on July 6, 2019
Cellebrite Processing Anomaly (EFTA00089804): Cellebrite extracted
205,000+ images that "all look empty" from iPhone 1B71. An analyst asked: "Is it possible that FBI removed some photos beforehand if they were cp?" Additionally, 1,107 emails were withheld as potentially privileged. The blank images could result from corrupted data, encrypted thumbnails, deleted images leaving empty placeholder files, or processing artifacts. The analyst's question about prior FBI removal is documented but unresolved.
D. iPads
Per EFTA00028481 and EFTA00018089:
- Subject line: "Epstein iphone/ipad privilege reviews"
- Data was extracted and sent for privilege review
- A separate drive was created containing data from "several of Epstein's phones and ipads"
E. Definitive FBI Accounting: March-July 2025 Evidence Review (DS9 Expansion)
In 2025, newly appointed FBI Director Patel and Deputy Director Bongino requested a complete accounting of all Epstein evidence from FBI NY field office. DS9 contains the resulting internal communications.
No Sexual Abuse Videos Found (EFTA00164742, March 21, 2025):
AUSA Maurene Comey's response to Director Patel and DD Bongino:
"There were no videos of any sexual abuse identified at any point in the investigation."
Over ONE MILLION images/videos reviewed. FBI had no legal authority to seize 2019 surveillance videos from residences.
Nude photos of victims -- "victims are alone in these photos." No males present.
Definitive Content Breakdown (EFTA00164897, July 10, 2025 Director's Call; EFTA00161426):
| ---------- | -------- | ------------ |
| Total images/videos extracted from devices | 1,000,000+ | 100% |
| Marked responsive | ~34,000 | ~3.4% |
| Highly Responsive Material | 85 GB | -- |
| CSAM (commercial, NOT self-produced) | 15-20 images | <0.001% |
| Adult pornography/erotica/"age-difficult" | ~30,600 | ~90% of responsive |
| Personal or generic internet images | ~3,060 | ~9% of responsive |
Victim Accusations Against Others (EFTA00164897): "Approximately 4-5 victims accused other adult men sexually abused them. There was not enough evidence to federally charge these individuals, so the cases were referred to local law enforcement." Also: "Approximately 4-5 victims accused other adult women to have taken part in sexual abuse (threesomes with the minor), including Epstein's girlfriend who was approximately 18-20 years of age at the time."
Evidence Items Seized: "sex toys, massage tables, framed photos, photo albums, thumb drives, hard drives, computers, tapes, CDs/DVDs, iPads, personal documents, notes, writing tablets/binders, clothing items, logbooks, contact lists, blueprints."
Evidence Custody (EFTA00164740, March 21, 2025): All evidence seized in the 50D (sex trafficking) and 90A (death investigation) cases remains in FBI custody. CART creates 2 bit-for-bit copies of all digital evidence.
Devices Still Under Review April 2025 (EFTA00164855): 6 years after seizure, device examination had not been fully completed.
DOJ Conclusions (EFTA00163550, July 2025): DOJ concluded "no incriminating client list," no evidence of blackmail. AG Bondi stated many videos "turned out to be child porn" and will "never be released. Never going to see the light of day." DOJ reviewed "more than 300 gigabytes of data."
F. Steve Bannon's iPhone (Cross-case discovery)
Per EFTA00025553, EFTA00030999:
- During the We Build the Wall (WBTW) case review, an FBI reviewer was examining Steve Bannon's iPhone 7 on Cellebrite
- Found an image of Trump and Ghislaine Maxwell on Bannon's phone
- Screenshot from Cellebrite was attached and flagged to the Epstein/Maxwell case team
- Government determined "no need to do anything with this one"
PART IV: MCC SURVEILLANCE SYSTEM -- DVR FORENSICS
This is arguably the most critical forensic failure in the entire case.
The DVR System Architecture:
- 147 total cameras at MCC New York (EFTA00164855) -- total video data: 8.08 TB
- 128 cameras assigned to recording
- DVR 1: 16 hard drives, operational, data available 7/23 - 8/10/2019
- 2 camera angles of interest recorded to DVR 1
- DVR 2: 16 hard drives, CATASTROPHIC FAILURE
- System failure on 7/29/2019
- 2 hard drive failures on 8/8/2019 (2 days before Epstein's death)
- Only available video: 7/15 - 7/29/2019
- 3 of 4 camera angles of interest in the SHU recorded to DVR 2
- Sally port camera (elevator bank #1 and #2) on DVR 2
Timeline of DVR 2 Failure:
| Sept 2018 | BOP awards contracts to Company 1 (NiceVision) and Company 2 for camera system upgrade |
| July 29, 2019 | DVR 2 suffers "catastrophic disk failures" -- 2-3 hard drives fail, most of system stops recording |
| July 30, 2019 | Epstein transferred back to SHU |
| Aug 8, 2019 | DVR 2 recording failure first detected by MCC staff; Warden claims he was unaware |
| Aug 9, 2019 | MCC obtains replacement hard drives but does not complete repairs |
| Aug 10, 2019 | EPSTEIN FOUND DEAD AT ~6:30 AM -- Most SHU cameras NOT recording |
| Aug 10, 2019 | Hard drives seized from DVR 2 at 4:30 PM EDT |
| Aug 12, 2019 | NiceVision arrives to begin installation of replacement system |
| Aug 14, 2019 | FBI CART/MXU team downloads priority cameras from DVR 1 |
| Aug 14, 2019 | Password obtained from MCC contractor; DVR 1 data reviewed |
| Aug 14, 2019 | MCC contractor enters OTD Lab to work on DVR 2 |
| Aug 16, 2019 | DVR system shipped to FBI Digital Forensics Analysis Unit (DFAU), Quantico, VA |
EFTA00039025 - OIG Report):">FBI Forensic Analysis of DVR 2 (EFTA00039025 - OIG Report):
"The FBI's Digital Forensics Analysis Unit in Quantico, Virginia, received MCC New York's DVR system on August 16, 2019, and began to conduct a forensic analysis of the system. According to FBI forensic reports, DVR 2 did not start successfully. The Digital Forensics Analysis Unit found that the system contained three faulty hard drives. The FBI forensic reports state that the three drives were repaired by an FBI Advanced Data Recovery Specialist, but the DVR was never able to be assembled successfully. The forensic reports further state that an FBI computer scientist and the Company 1 Technician reviewed the DVR 2 controller logs and found that there had previously been 'catastrophic disk failures' and no recordings would have been available after July 29, 2019."
Seized DVR 2 Hard Drives (FBI CART Evidence Logs):
Per EFTA00023970-75, individual collected item logs were created for each drive:
| NYCO Number | Description | Serial Number | Date Collected |
| ------------- | ------------- | --------------- | ---------------- |
| NYC023578 | Seagate Barracuda 500GB HDD, ST500DM002 | S/N Z3T6CJJA | 08/10/2019 4:30 PM |
| NYC023579 | Hitachi 500GB HDD, HDS721050CLA662 | S/N JP1572JE36A13K | 08/10/2019 4:30 PM |
| NYC023580 | Seagate Barracuda 500GB HDD, ST500DM002 | S/N Z3T6CFSX | 08/10/2019 4:30 PM |
| NYC023582 | Hitachi 500GB HDD, HDS721050CLA662 | S/N JP1572JE36MWNK | 08/10/2019 4:30 PM |
| NYC023583 | Seagate Barracuda 500GB HDD, ST3500320NS | S/N 9QMBEC75 | 08/10/2019 4:30 PM |
All documented as: "Submission of CART Evidence [number]: One (1) [make/model] from MCC Nice Vision DVR2 Surveillance System ([X] of 18)"
Result: The 3 of 4 cameras covering the SHU where Epstein died had NO recoverable recordings from after July 29, 2019. Per
EFTA00164855: "Cameras in SHU not active at time of death."
EFTA00164855)">Contraband Phone — Inmate Michael Thomas, NOT Epstein (EFTA00164855)
Device 1B46, previously listed in the CART inventory as an "EMTEC 16GB USB," was clarified in April 2025: it was actually a contraband phone belonging to Inmate Michael Thomas, not Epstein. An 80 GB Cellebrite report was generated, but nothing in the extraction related to Epstein.
Multiple OIG interview transcripts document extensive questioning about an unmonitored phone call provided to Epstein on August 9, 2019 -- the night before his death:
"This call was done on an unmonitored line."
"It is extremely concerning why this call would have been placed, and why it would be done on an unmonitored line."
"All inmate phone calls are recorded. So, why would an employee go on their own and provide a phone call to an offender?"
"It could have potentially led to the incident, but we don't, we will never know."
A male answered the phone and it was "handed off." The investigation never identified who Epstein spoke with.
EFTA00068331)">MCC Document Shredding -- Full Text (EFTA00068331)
FBI Crisis Intake memorandum, August 16, 2019 (6 days after Epstein's death):
"4-5 bags of shredded documents" produced by BOP After-Actions team.
Staff member said: "this isn't the first time I've had to do things like this."
Related documents: EFTA00078396 (OIG forwarding the shredding report), EFTA00092927 (USAO response: "Can we take a look at the dumpster ASAP?"), EFTA00089106 (internal research into 18 USC 1519 elements -- obstruction statute for document destruction). The urgency of the dumpster request and the 18 USC 1519 research indicates prosecutors took the shredding allegation seriously.
FD-302 interview confirming:
"There were no entries of counts in TRUSCOPE the entire night."
"If technology is down, the Correctional Officers also [are required to maintain manual counts]."
The 3:00 AM and 5:00 AM counts -- designed to "physically count and confirm each person in each cell" -- were not recorded. Combined with the DVR failure timeline, this establishes a near-complete surveillance gap in the SHU area on the night of Epstein's death. (DVR 1, covering other areas of MCC including 2 camera angles of interest, remained operational.)
PART V: THE 2005 PALM BEACH COMPUTER -- UNSEARCHED
EFTA00015823 -- Letter from U.S. Attorney (April 9, 2021)">Source: EFTA00015823 -- Letter from U.S. Attorney (April 9, 2021)
16 DVD-R discs were found in the FBI Florida Office's file, described as:
"Palm Beach County Sheriff's Office Case # 05-250067 Epstein EnCase Files Palm Beach PD DVD-R for General VERBATIM DVD Computer Crimes Unit"
Each disc labeled "Disk 1 of 16" through "Disk 16 of 16."
What happened:
When FBI NY first received the Florida file, agents could not open the files and believed they were inoperable
The Government later discovered the files were consistent with a forensic image of a computer (EnCase format)
An FBI computer specialist confirmed: the discs contain a forensic image of a computer seized from Epstein's Palm Beach residence in ~2005
The 2005 search warrant authorized seizure but did NOT authorize searching the contents of electronic devices
No subsequent warrant was ever obtained by local or federal authorities
The Government stated it had no lawful basis to review the forensic image
The Government stated it did not intend to obtain a warrant to search it
The Government could not permit defense to review the contents either
Epstein's estate was "repeatedly unwilling to waive any attorney-client privileges" regarding devices
This means a complete forensic image of Epstein's computer from 2005 -- the peak period of his abuse -- has never been examined by federal authorities. (Note: The Palm Beach County Sheriff's Office Computer Crimes Unit created the EnCase image and may have conducted local examination, possibly including in connection with the 2006 grand jury — but this is not addressed in the federal documents.)
PART VI: EVIDENCE HANDLING FAILURES & CHAIN OF CUSTODY GAPS
A. Massive Delays in Processing (Feb 2020 - Nov 2020)
The email chain in EFTA00009802, 00009941, 00016180, 00016425, 00032065 documents a saga of dysfunction:
| July-Aug 2019 | Devices seized from NY mansion, USVI, and Epstein's person |
| Nov 2019 | First hard drive produced to prosecutors with 38 folders and no device attribution |
| Feb 15, 2020 | Prosecutors still cannot tell what they received: "it's basically impossible for us to keep track" |
| Feb 24, 2020 | Prosecutors create template spreadsheet requesting basic device tracking |
| March 2, 2020 | FBI CART delayed by network teardown: "they mandated we delete old stuff (about 400 TB worth)" |
| March 9, 2020 | AUSA writes: "Notwithstanding their many promises to us about quick and effective processing of the 60+ devices they seized, the FBI is completely fucking us on this." |
| March 9, 2020 | Production data has no email-attachment linking, no native file links, mismatched control numbers |
| April 7, 2020 | "This has been pending for almost two months and we still don't have a very basic list" |
| May 8, 2020 | FBI reduced to 1 day/week due to COVID; "things have been stretched out by a factor of 5" |
| May 12, 2020 | FBI CART warns: "Relativity is NOT a forensic tool. It is incapable of dealing with... free space, slack space, and system files" |
| May 15, 2020 | AUSA still needs serial numbers for search warrant; FBI provides updated descriptions |
| May 29, 2020 | FBI provides updated item descriptions; notes many thumb drives/SD cards lack external S/Ns |
| June 1, 2020 | AUSA: "I confess I'm having a hard time tracking the updates to this" |
| June 23, 2020 | FBI produces spreadsheet; internal staff "can't match up all the numbers with 1B numbers" |
| July 7, 2020 | "Everything with the exception of a couple of items are ready" |
| July 23, 2020 | FBI provides color-coded evidence status spreadsheet |
| July 24, 2020 | 71,000 documents in initial 7 devices are zero bytes (empty files) |
| July-Aug 2020 | 2 servers with physically failed drives sent to HQ for recovery |
| Aug 2020 | "Since they are physically broken, data recovery may or may not be possible. It can be a very long process." |
| Oct 14, 2020 | FBI confirms: "All the devices and media have been available through our CAIR system for over a year" |
| Oct 15, 2020 | Device NYCO24342 folders are empty -- no images/videos extracted |
| Oct 15, 2020 | Multiple devices still pending: NYCO24328, 24329, 24353, 24365, 24366, 24371, 24383 |
| Nov 9, 2020 | Sixth Production -- iPhone NYCO24318 finally produced |
| Jan 27, 2021 | Highly confidential responsive material (nude images) compiled from CART evidence |
Per EFTA00009802:
"The data we've received has no way to put any emails and attachments together. So if an email says, 'see the attached flight records,' for example, we have no way of linking that up with the records themselves."
"The load file has no link to the native file, so when we load the data to the database, there's no way to have the native files show up in the database."
"The control numbers in the load file don't match up to the native files. So we have two sets of numbers and no way to match up anything."
C. FBI vs. USAO Methodology Conflict
Per EFTA00016425 (FBI CART Coordinator):
"Just to be clear. The US Attorney's Office (or its contractors) are not 'processing' anything. You are taking files that I will be extracting from processed evidence and putting them into an E-Discovery tool (Relativity) to do a taint review. Relativity is NOT a forensic tool. It is incapable of dealing with many things that are found forensically on a computer like free space, slack space, and system files to name a few."
"Sorry it has taken so long, but we are talking about terabytes worth of data over multiple forms of digital evidence. Phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers. We have gotten past encryption on multiple devices."
D. Encryption Challenges
Per EFTA00037386, EFTA00016425:
- 3 iPads sent for unlocking
- 1 iPhone sent for unlocking
- 1 iMac locked and not able to be imaged
- 1 external hard drive imaged but encrypted
- "We have gotten past encryption on multiple devices"
E. Missing / Incomplete Device Data
Devices with known issues:
NYCO24342 -- Folders empty, no images/videos extracted
NYCO24376-380 -- Drives still being processed months after seizure
NYCO27913 -- Listed as provided on 7/23 but NOT on the disc
2 servers -- Multiple drives physically failed; sent to HQ for recovery; outcome unknown
3 iPads and 1 iPhone -- Sent for unlocking; status unclear
1 iMac -- Locked, unable to be imaged
71,000+ zero-byte files in initial 7 devices
Email attachments disconnected from parent emails in forensic tool
PART VII: CAIR SYSTEM AND EVIDENCE ACCESS
The FBI maintained evidence access through the CAIR (Case and Analysis Information Repository) system:
"All the devices and media have been available through our CAIR system for over a year. I suggest you review through that system. I have already given several people access to those machines."
Additional personnel were granted CAIR access for evidence review:
- Multiple FBI agents added to CART evidence review for JE (EFTA00037686)
- SDNY was expected to review some devices while FBI reviewed the remaining balance
- "All the additional exports with the exception of 6 machines have been completed"
PART VIII: DISCOVERY PRODUCTION TO DEFENSE / MDC
A. Maxwell's Limited Access
Per EFTA00021015, EFTA00013222:
- Maxwell was provided a laptop computer at MDC for discovery review
- She was initially given access only on weekdays
- The prison computer was incapable of reading: native files, Excel files, some video/audio, and anything requiring Cellebrite software
- Defense argued Maxwell needed weekend and holiday access to review "millions of pages of discovery"
- She lost "10 or more hours per week" due to laptop delivery delays and MDC computer problems
B. Hard Drive Delivery to MDC
Per EFTA00016292, EFTA00023962, EFTA00026711, EFTA00026713:
- Multiple email chains regarding "delivery of hard drive to MDC for discovery production to inmate"
- Hard drives with loaded discovery needed to be non-encrypted (no password) for MDC delivery
- MDC required drives to go through their own processing before inmate access
- Government was "not permitted to send a drive that our IT department did not load" to MDC
C. Highly Confidential Evidence Review at 500 Pearl Street
Per EFTA00015738, EFTA00020322, EFTA00026890:
- ~2,100 images/videos could only be reviewed at 500 Pearl Street (FBI facility)
- Single laptop provided with Cellebrite software
- Images organized by source device folder
- FBI not permitted to make duplicates of "obscene material"
- Defense counsel attorneys (Laura Menninger, Jeff Pagliuca, Christian Everdell, Bobbi Sternheim) coordinated access
PART IX: RELATIVITY DATABASE MANAGEMENT
EFTA00019518, 19847, 21983, 22047, 29672, and many others)">Source: Multiple EFTA documents (EFTA00019518, 19847, 21983, 22047, 29672, and many others)
The evidence was loaded into the Relativity e-Discovery platform under the case name "US v. Epstein":
- Database access: EFTA00019518 -- "We'd like to set up a Relativity database, please, for U.S. v. Epstein"
- Multiple databases existed: one for investigation materials, one for Maxwell discovery
- Phone number searches conducted within Relativity (EFTA00024903)
- Defense discovery tasks coordinated through the Relativity databases (EFTA00021983)
- "FBI Files from Florida Office" folder contained 26,164 documents (EFTA00022047)
- Materials loaded in multiple batches with various production indices
EOUSA Relativity Login provided for FBI and SDNY access (
EFTA01653704, 01653715, 01653721)
PART X: SEARCH WARRANT DOCUMENTATION
A. Original Device Search Warrants
- Draft SW for JE phone & iPad (EFTA00015561) -- July 14, 2019
- "Attached for review is a draft search warrant application for the phone and iPad that were seized from Epstein on the day of his arrest"
- Search warrant and supporting affidavit for Epstein devices responsiveness review
- Review protocol for image and video files created October 19, 2020
B. USVI / Little St. James Search
- FBI executed search warrant on Little St. James Island (referenced in EFTA01731021)
- USVI evidence included multiple servers with server racks, 25+ devices
C. Evidence Return
- EFTA01731021 references: "Return of Property to Frank Senerchia on 08/[date]"
- Some items returned to non-suspects after processing
PART XI: KEY PERSONNEL (Redacted but Identifiable by Role)
| Role | Affiliation | Key Documents |
| ------ | ------------- | --------------- |
| Paralegal Specialist | USAO SDNY | EFTA00030562 (production coordination) |
| FBI Special Agent | FBI NY Violent Crimes Task Force | EFTA00017948-52 (DVR chain of custody) |
| ITS/Forensic Examiner (FE) | FBI | EFTA01731021 (July 18, 2019 examination) |
| Digital Forensics Analysis Unit | FBI Quantico, VA | EFTA00039025 (DVR 2 forensic analysis) |
| Advanced Data Recovery Specialist | FBI HQ | EFTA00039025 (repaired faulty DVR drives) |
PART XII: PHYSICAL EVIDENCE PHOTOS (Image Analysis Database)
From the image catalog database, photographs of Epstein's residences captured the following digital devices in situ:
| EFTA Number | Location | Device Observed |
| ------------- | ---------- | ----------------- |
| EFTA00000015 | Residence office | Desk with multiple computer monitors, keyboards, office supplies |
| EFTA00000016 | Residence | White desk, large monitor setup on wall (multiple monitors) |
| EFTA00000017 | Residence office | 4 large computer monitors mounted on wall, desk with keyboard/mouse/telephone |
| EFTA00000020 | Residence | Black server rack with servers and networking devices, fire helmet on top |
| EFTA00000026 | Residence | Suitcase, white desk with computer monitor/keyboard/mouse |
| EFTA00000146 | Residence | Large wooden desk with computer, keyboard, mouse |
| EFTA00000147 | Residence | Wooden desk with computer monitor, keyboard, mouse |
| EFTA00000164 | Massage room | Massage table, cabinet with bottles (no digital devices) |
| EFTA00000276 | Closet | Stack of DVDs or similar media, mannequin torsos |
PART XIII: CRITICAL EVIDENCE GAPS AND UNRESOLVED QUESTIONS
1. The 2005 Palm Beach Computer
NEVER SEARCHED. 16 DVDs containing an EnCase forensic image of a computer seized from Epstein's Palm Beach home during the peak abuse period. No warrant was ever sought. Epstein's estate refused to waive privilege. This evidence remains unexamined.
2. The MCC DVR 2 Recordings
IRRECOVERABLE. Despite repairs by an FBI Advanced Data Recovery Specialist, DVR 2 containing footage from 3 of 4 SHU camera angles "was never able to be assembled successfully." The catastrophic disk failures pre-dating Epstein's death by 12 days meant no recordings existed from the cameras covering his cell after July 29, 2019.
3. Two Servers with Failed Drives
Two servers from the USVI seizure had physically failed drives requiring FBI HQ specialists. The examiner stated: "Since they are physically broken, data recovery may or may not be possible." The final outcome of this recovery effort is not documented in the files reviewed.
4. Six Unfinished Machine Exports
Per EFTA00037676 (Oct 2020): "All the additional exports with the exception of 6 machines have been completed." The status of these 6 machines is not resolved in the available documents.
5. Locked Apple Devices
At least 1 iMac that could not be imaged and 3 iPads + 1 iPhone sent for unlocking. Whether all were eventually unlocked is not clearly documented.
6. 71,000 Zero-Byte Files
The initial production of 7 devices contained approximately 71,000 empty files. The FBI CART examiner said this was "not unusual for the software to find such files" but the issue was flagged for further review. Whether these represented actual data loss is unclear.
7. NYCO24342 -- Empty Device
Device folders were completely empty. Whether this device genuinely contained no data or reflects an extraction failure is not documented.
8. NYCO27913 -- Missing from Disc
Listed on the evidence spreadsheet as provided on 7/23 but physically absent from the disc delivered. Disposition unclear.
9. Disconnected Email Attachments
The inability to link emails to their attachments in the initial 1.1 million document production means potentially critical evidence connections (e.g., "see the attached flight records") may have been missed during review.
10. 400 TB Deletion Order
The FBI CART team was ordered to "delete old stuff (about 400 TB worth)" during their network replacement. This appears to reference general FBI data management rather than Epstein evidence specifically.
EFTA00157526)">11. Camera-in-Clock Practice -- 2003 Origin (EFTA00157526)
Palm Beach Police Department report from 2003 documents a burglary at 358 El Brillo Way (Epstein's Palm Beach residence). Epstein had purchased a spy camera from a store on Okeechobee Boulevard and concealed it "in a clock in his office" to catch a suspected thief. The camera successfully recorded the suspect at 4:28 AM with $4,000 in bait money involved. This is the earliest documented instance of Epstein's camera-in-clock practice -- 2 full years before the 2005 sex trafficking investigation. It establishes surveillance expertise, equipment procurement channels, and contextualizes the later contradiction between the FBI CID finding of "no cameras found in bedrooms" (EFTA00038617) and the Maxwell prosecution memo stating "Epstein had cameras in his clock" (EFTA02731226).
EFTA00172146)">12. NARA Unauthorized Destruction Investigation (EFTA00172146)
In April 2025, the National Archives and Records Administration (NARA) investigated an ex-FBI agent whistleblower's claims that "people inside the FBI have been working night and day to destroy files on these servers." NARA contacted FBI's Information Management Division (IMD), which contacted INSD (Internal Security Division). INSD declined to investigate without more specific allegations. IMD hit a "dead end." OGC/CDC was to draft a response. This is the only documented federal investigation into potential evidence destruction -- and it was not pursued further after INSD declined to investigate without more specific allegations.
EFTA00161477, EFTA00161474)">13. Senator Blackburn Evidence Request -- Unanswered (EFTA00161477, EFTA00161474)
Senator Marsha Blackburn sent a letter to Director Patel on February 24, 2025, requesting complete flight logs from Epstein's private jet and helicopter, any records in Maxwell's possession containing names of individuals, and additional items. FBI internal email from May 6, 2025: "Did we ever get the response?" -- "I did not." As of May 2025, the FBI had not responded to a sitting Senator's formal request for Epstein evidence -- 10 weeks after the letter was sent.
EFTA00163673)">14. FBI Redaction of Trump Name (EFTA00163673)
Bloomberg reported that the FBI FOIA team "played a central role in redacting former President Donald Trump's name -- and the names of other high-profile individuals -- from the Epstein investigation files" using FOIA privacy exemptions.
APPENDIX A: DOCUMENT REFERENCE INDEX
Core Forensic Processing Documents:
- EFTA00009802 -- "FBI is completely fucking us" email; 60+ devices; 38 folders problem
- EFTA00009941 -- Device list request; COVID delays; "reduced to 1 day a week"
- EFTA00010440 -- 40 devices from NY + 60+ CDs + 25 USVI devices breakdown
- EFTA00013448 -- "Still some Apple items from NY that need to be produced"
- EFTA00016180 -- Updated item descriptions; serial number coordination
- EFTA00016425 -- "Relativity is NOT a forensic tool" + encryption discussion
- EFTA00016912 -- Hard drive from FBI CART for Relativity upload
- EFTA00020213 -- Detailed NYCO device list; 5 devices still pending
- EFTA00029601 -- FBI Forensic Examiner 5-page CV (all certifications)
- EFTA00030562 -- Sixth Production; iPhone NYCO24318 finally produced
- EFTA00032065 -- Complete email chain showing processing timeline
- EFTA00037386 -- CART inventory: 3 iPads, 1 iPhone, 1 iMac locked, 1 encrypted HDD
- EFTA00037913 -- EpsteinNYEvidence.xlsx spreadsheet reference
- EFTA00038465 -- Master CART Evidence inventory with all 1B numbers
Cellebrite-Specific Documents:
- EFTA00015738 -- 2,100 images from devices; Cellebrite required for Apple
- EFTA00015786 -- Three categories of highly confidential images
- EFTA00020322 -- Cellebrite software provided on review drive
- EFTA00021015 -- Sternheim letter: MDC computer cannot run Cellebrite
- EFTA00025553 -- Bannon iPhone 7 reviewed on Cellebrite; Trump-Maxwell photo found
- EFTA00026890 -- Obscene material restrictions; single laptop for review
- EFTA00029601 -- Examiner's Cellebrite certifications (CCO + CCPA)
- EFTA00030999 -- Detailed Bannon/Cellebrite/Trump-Maxwell photo email
DVR / MCC Surveillance Documents:
- EFTA01649190 -- DVR system architecture: 192 cameras, 2 DVR systems, 16 HDs each
- EFTA00017948 -- DVR Update: password obtained, DVR 2 not running
- EFTA00017949 -- Download complete: priority cameras from DVR 1
- EFTA00023970-75 -- Individual collected item logs for DVR 2 hard drives (with S/Ns)
- EFTA00039025 -- OIG Report: catastrophic disk failures, DFAU Quantico analysis
2005 Palm Beach Computer:
- EFTA00015823 -- Government letter: 16 EnCase DVDs never searched; no legal authority
Discovery Production / MDC:
- EFTA00013222 -- Defense complaint: government not complying with discovery
- EFTA00021015 -- Sternheim letter to Judge Nathan re: laptop access
- EFTA00022050 -- Image/Video File Review Protocol with search warrant attachments
Evidence Access / CAIR:
- EFTA00037676 -- "All devices available through CAIR for over a year"
- EFTA00037686 -- Adding personnel to CART/CAIR for JE evidence review
APPENDIX B: TIMELINE OF KEY FORENSIC EVENTS
| ~2005 | Palm Beach PD seizes computer from Epstein residence; EnCase forensic image created on 16 DVDs |
| July 6, 2019 | Epstein arrested at Teterboro; iPhone and iPad seized from person |
| July 6, 2019 | Search warrant executed at 9 E. 71st Street (NY mansion) |
| July 14, 2019 | Draft search warrant for JE phone & iPad |
| July 16, 2019 | Marc Fernich requests return of personal effects; electronic devices retained per warrant |
| July 18, 2019 | ITS/Forensic Examiner begins work on devices |
| July 29, 2019 | MCC DVR 2 catastrophic disk failure |
| Aug 9, 2019 | FBI queries CART: "how many electronic items processed? analyzed? encrypted?" |
| Aug 9, 2019 | CART inventory: 3 iPads for unlock, 1 iPhone for unlock, 1 iMac locked, 1 HDD encrypted, 2 iMacs processed, 1 iMac pending, 2 Windows PCs processed, 1 laptop processed, loose media processed |
| Aug 10, 2019 | Epstein found dead |
| Aug 10, 2019 | DVR 2 hard drives seized at 4:30 PM |
| Aug 14, 2019 | DVR 1 priority camera footage downloaded; CART/MXU team on site |
| Aug 16, 2019 | DVR system shipped to FBI DFAU, Quantico |
| Aug-Sept 2019 | USVI search warrant executed on Little St. James Island |
| Aug 29, 2019 | First hard drive loaded to Relativity for privilege review |
| Nov 2019 | Hard drive produced with 38 folders; 1.1 million documents |
| Feb 2020 | Prosecutors unable to determine what data matches which devices |
| March 9, 2020 | "FBI is completely fucking us on this" email |
| May 2020 | COVID reduces FBI CART to 1 day/week |
| May 12, 2020 | FBI CART explains encryption progress; Relativity limitations |
| May 29, 2020 | Updated device descriptions with serial numbers provided |
| July 23, 2020 | Color-coded evidence status spreadsheet; servers with failed drives flagged |
| Oct 2020 | CAIR access confirmed; 6 machines still pending |
| Oct 19, 2020 | Image/Video File Review Protocol created |
| Nov 9, 2020 | Sixth Production: iPhone NYCO24318 produced |
| Jan 27, 2021 | Highly confidential responsive material compiled from CART evidence |
| Feb 1, 2021 | Sternheim letter re: MDC laptop access and Cellebrite |
| March 16, 2021 | Physical evidence spreadsheets provided to defense; 2,100 HC images |
| April 9, 2021 | Government letter: 2005 Palm Beach computer will NOT be searched |
| June 2021 | Trump-Maxwell photo found on Bannon iPhone 7 via Cellebrite review |
Report compiled: 2026-02-07 | Updated 2026-02-12 with DS9/DS11 full corpus findings (1,380,937 documents)
Databases searched: 4 primary databases + full_text_corpus.db
Key updates: March-July 2025 FBI evidence review (no sex abuse videos, 15-20 commercial CSAM, 85 GB responsive), camera-in-clock 2003 origin, MCC 147 cameras/8.08 TB, contraband phone = Inmate Thomas, iPhone 205K blank images, MCC shredding full text, unmonitored phone call Aug 9, NARA destruction investigation, Senator Blackburn request unanswered, DOJ 2025 conclusions, FBI Trump name redaction