EFTA00174637.pdf

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) UNSUB; JEFFREY EPSTEIN — VICTIM; DEATH INVESTIGATION Digital Evidence Tracking (U//FOUO) Executive Summary: The New York Division (NY) initiated a death investigation for the apparent suicide of Jeffrey EPSTEIN at the Metropolitan Correctional Center (MCC) which occurred on 10 August 2019. On 12 August 2019, OTD was contacted by the NY Division for assistance with a MCC video surveillance system consisting of two Digital Video Recorders (DVR1 - operational and DVR2 — not operational) and a controller. The NY Division Computer Analysis Response Team (NY CART) has collected digital evidence items associated with this investigation. OTD is currently tracking 37 digital evidence items (associated with DVR1and DVR2): (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B1— Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST500DM002, S/N 8/15/2019 - Collected, in evidence control Z3T6CJJA (DVR2 —1 of pending shipment to OTD. 18) NYC023578 1B2 - Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Hitachi 500GB HDD, DFAU Recovery Program assessment ongoing. 8/16/2019 HD5721050CLA662, S/N JP1572JE36A13K 8/15/2019 - Collected, in evidence control (DVR2 — 2 of 18) pending shipment to OTD. NYC023579 UNCLASSIFIED//FOUO EFTA00174637  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B3 — Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data N/A N/A Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, STSOODM002, S/N 8/15/2019 - Collected, in evidence control Z3T6CF5X (DVR2 — 3 pending shipment to OTD. of 18) NYC023580 1B4 - Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data N/A N/A Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST3500320145, S/N 8/15/2019 - Collected, in evidence control 9QM8MT9P (DVR2 4 pending shipment to OTD. of 18) NYC023581 1B5 - Hard Drive — OTD - 8/21/2019 — Repaired, data is being recovered — Damaged N/A Started: Hitachi 500GB HDD, DFAU 26% complete. 8/16/2019 HDS721050CLA662, S/N: 8/16/2019 — Device arrived at OTD. Data JP1572JE36MWNK Recovery Program assessment ongoing. (DVR2 — 5 of 18) Pending delivery of donor parts for repair. NYC023582 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA00174638  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B6 — Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data N/A N/A Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST3500320NS, S/N 8/15/2019 - Collected, in evidence control 9QM8EC75 (DVR2 — 6 pending shipment to OTD. of 18) NYC023583 1B7 — Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/15/2019 - Collected, in evidence control Z1M1PZPE (DVR2 — 7 pending shipment to OTD. of 18) NYC023584 1B8 — Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Western Digital DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, WD5000AVDS- 8/15/2019 - Collected, in evidence control 63U7B1, S/N pending shipment to OTD. WCAV9Z911026 (DVR2 - 8 of 18) NYC023585 UNCLASSIFIED//FOUO EFTA00174639  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items —As of 21August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B9 — Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Western Digital DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, WD5000AAKX- 8/15/2019 - Collected, in evidence control 60U6AA0, S/N pending shipment to OTD. WCC2EJUC34CJ (DVR2 -9 of 18) NYC023586 1610- Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST3500320NS, S/N 8/15/2019 - Collected, in evidence control 9QM8MSEZ (DVR2 — pending shipment to OTD. 10 of 18) NYC023587 1611- Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/15/2019 - Collected, in evidence control Z1M1PX26 (DVR2 —11 pending shipment to OTD. of 18) NYC023588 1B12 - Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/15/2019 - Collected, in evidence control Z1M1Q1FX (DVR2 — pending shipment to OTD. 12 of 18) NYC023589 UNCLASSIFIED//FOUO EFTA00174640  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B13 — Hard Drive - OTD - 8/19/2019 — Damaged heads. DFAU performed Damaged TBD Started: Western Digital DFAU head stack swap, data is slowly imaging. 97% 8/16/2019 500GB HDD, complete. WD5000AVDS- 63U7B1, S/N 8/16/2019 — Device arrived at OTD. Data WCAV9T870016 Recovery Program assessment ongoing. (DVR2 —13 of 18) NYC023590 8/15/2019 - Collected, in evidence control pending shipment to OTD. 1B14 —Hard Drive - OTD - 8/21/2019 — Repairs underway, data is being Damaged TBD Started: Western Digital DFAU recovered. 8/16/2019 500GB HDD, WD5000AAKX- 8/16/2019 — Device arrived at OTD. Data 60U6AA0, S/N Recovery Program assessment ongoing. WCC2E0DE83YK Pending delivery of donor parts for repair. (DVR2 —14 of 18) NYC023591 8/15/2019 - Collected, in evidence control pending shipment to OTD. IBIS — Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST3500320NS, S/N 8/15/2019 - Collected, in evidence control 9QM8MT6D (DVR2 — pending shipment to OTD. 15 of 18) NYC023592 UNCLASSIFIED//FOUO EFTA00174641  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1616— Hard Drive - OTD - 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/15/2019 - Collected, in evidence control Z1M1PZ07 (DVR2 —16 pending shipment to OTD. of 18) NYC023593 1B17 — Hard Drive - OTD - 8/19/2019 — DFAU reports 100% data recovery, Damaged TBD Started: Seagate Constellation DFAU device is currently imaging. 8/16/2019 ES 500GB HDD, ST500NM0011, S/N 8/16/2019 — Device arrived at OTD. Data Z1M1L0YG (DVR2 —17 Recovery Program assessment ongoing. of 18) NYC023594 8/15/2019 - Collected, in evidence control pending shipment to OTD. 1B18 — Hard Drive- OTD- 8/19/2019 — DFAU reports partial data recovery Damaged TBD Started: Seagate Barracuda DFAU (44 bad sectors not recovered), device is 8/16/2019 500GB HDD, imaging. ST350032014 S/N 9QM8MSRR (DVR2 - 8/16/2019 — Device arrived at OTD. Data 18 of 18) NYC023595 Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA00174642  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items —As of 21August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B19 — Disk Array OTD - 8/16/2019 — Chassis and controller for TBD TBD Started: Chassis; Model#: SA- DFAU inoperable DVR2 arrived at OTD. Data Recovery 8/16/2019 6640S, SN: Program assessment ongoing. F96168201-004 and Disk Array Controller; Model#: NP-2000, SN: 43144902 (DVR2) 1B20 - DVR OTD - 8/16/2019 — DVR controller for operable DVR1 TBD TBD Started: Controller - Dell DFAU arrived at OTD. Data Recovery Program 8/16/2019 PowerEdge R420 DVR assessment ongoing. Controller, Barcode# SBMQZ12, Express service Code #: 11587249622, Manufacturer date: 20140829 (DVR1) 1B21— DVR System - OTD - 8/16/2019 — Operable DVR1 system arrived at TBD TBD Started: Disk Array Chassis DFAU OTD. 8/16/2019 containing 16 hard Drives; Model#: Premium 8600, 5N: 232476 and Disk Array Controller; Model#: NP-2000, SN: 43144901 (DVR1) UNCLASSIFIED//FOUO EFTA00174643  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items —As of 21 August 2019 1400 Description Physical Status Challenges Lawful Time in Process Location Access 1B22 —1B36 — OTD - 8/21/2019 — Arrived at QT on 8/20, in process N/A N/A TBD Derivative Evidence — DFAU with DFAU. 14 Hard Drives containing clone 8/19/2019 — Derivative evidence —clone copies copies of multiple of hard drives removed from DVR2. Collected Hard Drives from by DFAU UC Petronella to be delivered to OTD DVR2. on 8/20/2019 1B40 — Hard Drive - NY CART 8/19/2019 - Copy of all video available for N/A N/A N/A One (1) Seagate download for 8/10/2019, All relevant video 500GB hard drive, from Special Housing Unit floor 9 and Attorney serial number Visit area floor 3 from 7/23 to 8/10/2019, All W2AEXSJV, containing video available to download for 8/9 (THIS video downloaded DOWNLOAD FAILED) and video downloaded by from DVR1at MCC tech, (that is the wrong camera). No 1B — Hard drive OTD - 8/21/2019 — Damaged hard drive repaired, data Damaged N/A Started: containing video DFAU is being recovered (10 bad sectors). 8/19/2019 footage, HQQ0 18525 UNCLASSIFIED//FOUO EFTA00174644