EFTA00174648.pdf

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) UNSUB; JEFFREY EPSTEIN — VICTIM; DEATH INVESTIGATION Digital Evidence Tracking (U//FOUO) Executive Summary: The New York Division (NY) initiated a death investigation for the apparent suicide of Jeffrey EPSTEIN at the Metropolitan Correctional Center (MCC) which occurred on 10 August 2019. On 12 August 2019, OTD was contacted by the NY Division for assistance with a MCC video surveillance system consisting of two Digital Video Recorders (DVR1 - operational and DVR2 — not operational) and a controller. The NY Division Computer Analysis Response Team (NY CART) has collected digital evidence items associated with this investigation. OTD is currently tracking 36 digital evidence items (associated with DVR1and DVR2): (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B1— Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, STS00DM002, S/N 8/15/2019 - Collected, in evidence control Z3T6CJJA (DVR2 —1 of pending shipment to OTD. 18) NYCO23578 1B2 - Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Hitachi 500GB HDD, DFAU Recovery Program assessment ongoing. 8/16/2019 HD5721050CLA662, S/N JP1572JE36A13K 8/15/2019 - Collected, in evidence control (DVR2 — 2 of 18) pending shipment to OTD. NYCO23579 UNCLASSIFIED//FOUO EFTA00174648  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B3 — Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data N/A N/A Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, STS00DM002, S/N 8/15/2019 - Collected, in evidence control Z3T6CF5X (DVR2 — 3 pending shipment to OTD. of 18) NYC023580 1B4 - Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data N/A N/A Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST3500320NS, S/N 8/15/2019 - Collected, in evidence control 9QM8MT9P (DVR2 4 pending shipment to OTD. of 18) NYC023581 1B5 - Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data Damaged N/A Started: Hitachi 500GB HDD, DFAU Recovery Program assessment ongoing. 8/16/2019 HDS721050CLA662, Pending delivery of donor parts for repair. S/N: JP1572JE36MWNK 8/15/2019 - Collected, in evidence control (DVR2 — 5 of 18) pending shipment to OTD. NYC023582 1B6 - Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data N/A N/A Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST3500320NS, S/N 8/15/2019 - Collected, in evidence control 9QM8EC75 (DVR2 — 6 pending shipment to OTD. of 18) NYC023583 UNCLASSIFIED//FOUO EFTA00174649  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B7 — Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/15/2019 - Collected, in evidence control Z1M1PZPE (DVR2 — 7 pending shipment to OTD. of 18) NYC023584 1B8 — Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Western Digital DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, WD5000AVDS- 8/15/2019 - Collected, in evidence control 63U7B1, S/N pending shipment to OTD. WCAV9Z911026 (DVR2 - 8 of 18) NYC023585 1B9 — Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Western Digital DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, WD5000AAKX- 8/15/2019 - Collected, in evidence control 60U6AA0, S/N pending shipment to OTD. WCC2EJUC34CJ (DVR2 -9 of 18) NYC023586 UNCLASSIFIED//FOUO EFTA00174650  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items —As of 19 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1810— Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST3500320NS, S/N 8/15/2019 - Collected, in evidence control 9QM8MSEZ (DVR2 — pending shipment to OTD. 10 of 18) NYC023587 1B11- Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/15/2019 - Collected, in evidence control Z1M1PX26 (DVR2 —11 pending shipment to OTD. of 18) NYC023588 1812 - Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/15/2019 - Collected, in evidence control Z1M1Q1FX (DVR2 — pending shipment to OTD. 12 of 18) NYC023589 1613- Hard Drive - OTD - 8/19/2019 — Damaged heads. DFAU performed Damaged TBD Started: Western Digital DFAU head stack swap, data is slowly imaging. 8/16/2019 500GB HDD, WD5000AVDS- 8/16/2019 — Device arrived at OTD. Data 63U7B1, S/N Recovery Program assessment ongoing. WCAV9T870016 (DVR2 - 13 of 18) 8/15/2019 - Collected, in evidence control NYC023590 pending shipment to OTD. UNCLASSIFIED//FOUO EFTA00174651  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B14 —Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data Damaged TBD Started: Western Digital DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, Pending delivery of donor parts for repair. WD5000AAKX- 60U6AA0, S/N 8/15/2019 - Collected, in evidence control WCC2E0DE83YK pending shipment to OTD. (DVR2 -14 of 18) NYC023591 IBIS - Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST3500320NS, S/N 8/15/2019 - Collected, in evidence control 9QM8MT6D (DVR2 — pending shipment to OTD. 15 of 18) NYC023592 1616- Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/15/2019 - Collected, in evidence control Z1M1P207 (DVR2 — 16 pending shipment to OTD. of 18) NYC023593 UNCLASSIFIED//FOUO EFTA00174652  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1817— Hard Drive - OTD - 8/19/2019 — DFAU reports 100% data recovery, Damaged TBD Started: Seagate Constellation DFAU device is currently imaging. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/16/2019 — Device arrived at OTD. Data Z1M1L0YG (DVR2 —17 Recovery Program assessment ongoing. of 18) NYCO23594 8/15/2019 - Collected, in evidence control pending shipment to OTD. 1818— Hard Drive - OTD - 8/19/2019 — DFAU reports partial data recovery Damaged TBD Started: Seagate Barracuda DFAU (44 bad sectors not recovered), device is 8/16/2019 500GB HDD, imaging. ST350032ONS, S/N 9QM8MSRR (DVR2 - 8/16/2019 — Device arrived at OTD. Data 18 of 18) NYCO23595 Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. 1819 — Disk Array OTD - 8/16/2019 — Chassis and controller for TBD TBD Started: Chassis; Model#: SA- DFAU inoperable DVR2 arrived at OTD. Data Recovery 8/16/2019 6640S, SN: Program assessment ongoing. F96168201-004 and Disk Array Controller; Model#: NP-2000, SN: 43144902 (DVR2) UNCLASSIFIED//FOUO EFTA00174653  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B20 — DVR OTD - 8/16/2019 — DVR controller for operable DVR1 TBD TBD Started: Controller - Dell DFAU arrived at OTD. Data Recovery Program 8/16/2019 PowerEdge R420 DVR assessment ongoing. Controller, Barcode# SBMQZ12, Express service Code #: 11587249622, Manufacturer date: 20140829 (DVR1) 1B21- DVR System - OTD - 8/16/2019 — Operable DVR1 system arrived at TBD TBD Started: Disk Array Chassis DFAU OTD. 8/16/2019 containing 16 hard Drives; Model#: Premium 8600, SN: 232476 and Disk Array Controller; Model#: NP-2000, SN: 43144901 DVR1 1B22 — 1B36 - NY CART 8/19/2019 — Derivative evidence — clone copies N/A N/A TBD Derivative Evidence — of hard drives removed from DVR2. Collected 14 Hard Drives by DFAU UC Petronella to be delivered to OTD containing clone on 8/20/2019 copies of multiple Hard Drives from DVR2. UNCLASSIFIED//FOUO EFTA00174654