EFTA01683655.pdf

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) UNSUB; JEFFREY EPSTEIN — VICTIM; DEATH INVESTIGATION Digital Evidence Tracking (U//FOUO) Executive Summary: The New York Division (NY) initiated a death investigation for the apparent suicide of Jeffrey EPSTEIN at the Metropolitan Correctional Center (MCC) which occurred on 10 August 2019. On 12 August 2019, OTD was contacted by the NY Division for assistance with a MCC video surveillance system consisting of two Digital Video Recorders (DVR1 - operational and DVR2 — not operational) and a controller. The NY Division Computer Analysis Response Team (NY CART) has collected digital evidence items associated with this investigation. OTD is currently tracking 43 digital evidence items (associated with DVR1 and DVR2): (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019599 — Hard Drive 181 OTD - COMPLETE N/A N/A Started: — Seagate Barracuda ECU 8/22/2019 - Confirmed clone 1822 8/16/2019 S00GB HDD, (H4C1019619). Forensic Image on NYO OpWan. STSOODM002, S/N No further processing required. Item returned Completed: Z3T6CJJA (DVR2 —1 of 18) to OTD ECU pending shipment back to NYO. 8/22/2019 NYCO23578 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683655  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 19 Physical Status Challenges Lawful Time in Process Location Access HQQ0196O0 - Hard Drive 162 OTD - COMPLETE N/A N/A Started: — Hitachi 500GB HDD, ECU 8/22/2019 — Confirmed clone 1823 8/16/2019 HDS721050CLA662, S/N (HQQ019620). Forensic Image on NYO OpWan. JP1572JE36A13K (DVR2 — No further processing required. Item returned Completed: 2 of 18) NYC023579 to OTD ECU pending shipment back to NYO. 8/22/2019 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019601 — Hard Drive 163 OTD - COMPLETE N/A N/A Started: — Seagate Barracuda ECU 8/22/2019 — Confirmed clone 1824 8/16/2019 500GB HDD, (HQQ019621). Forensic Image on NYO OpWan. STS00DM002, S/N No further processing required. Item returned Completed: Z3T6CFSX (DVR2 — 3 of to OTD ECU pending shipment back to NYO. 8/22/2019 18) NYC023580 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683656  UNCLASSIFIED//FOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 19 Physical Status Challenges Lawful Time in Process Location Access HQQ019602 — Hard Drive 1B4 OTD - COMPLETE N/A N/A Started: — Seagate Barracuda ECU 8/22/2019 — Confirmed clone 1B25 8/16/2019 500GB HDD, (HQQ019622). Forensic Image on NYO OpWan. ST350032ONS, S/N No further processing required. Item returned Completed: 9QM8MT9P (DVR2 4 of to OTD ECU pending shipment back to NYO. 8/22/2019 18) NYCO23581 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019603 — Hard Drive 185 OTD - 8/22/2019 — Data recovery 33% completed. Not Damaged N/A Started: — Hitachi 500GB HDD, DFAU likely to be completed before 8/26/2019. 8/16/2019 HDS721050CLA662, S/N: JP15721E36MWNK (DVR2 8/21/2019 — Repaired, data is being recovered - - 5 of 18) NYCO23582 26% complete. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. Pending delivery of donor parts for repair. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683657  UNCLASSIFIED//FOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 18 Physical Status Challenges Lawful Time in Process Location Access HQQ019604 — Hard Drive 1B6 OTD - COMPLETE N/A N/A Started: — Seagate Barracuda ECU 8/22/2019 — Confirmed clone 1826 8/16/2019 500GB HDD, (HQQ019623). Forensic Image on NYO OpWan. ST350032ONS, S/N No further processing required. Item returned Completed: 9QM8EC75 (DVR2 - 6 of to OTD ECU pending shipment back to NYO. 8/22/2019 18) NYCO23583 8/16/2019 — Device arrived at OTD 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019605 — Hard Drive 1B7 OTD - COMPLETE N/A N/A Started: — Seagate Constellation ES ECU 8/22/2019 — Confirmed clone 1827 8/16/2019 500GB HDD, (HQC1019624). Forensic Image on NYO OpWan. STSOONMO011, S/N No further processing required. Item returned Completed: Z1M1PZPE (DVR2 — 7 of to OTD ECU pending shipment back to NYO. 8/22/2019 18) NYCO23584 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683658  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019606 — Hard Drive 188 OTD - COMPLETE N/A N/A Started: - Western Digital 500GB ECU 8/22/2019 — Confirmed clone 1828 8/16/2019 HDD, WD5000AVDS- (HQQ019625). Forensic Image on NYO OpWan. 63U7B1, S/N No further processing required. Item returned Completed: WCAV9Z911026 (DVR2 - to OTD ECU pending shipment back to NYO. 8/22/2019 8 of 18) NYC023585 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019607 — Hard Drive 1B9 OTD - COMPLETE N/A N/A Started: - Western Digital 500GB ECU 8/22/2019 — Confirmed clone 1829 8/16/2019 HOD, WD5000AAKX- (HQQ019626). Forensic Image on NYO OpWan. 60U6AA0, S/N No further processing required. Item returned Completed: WCC2EJUC34CJ (DVR2 —9 to OTD ECU pending shipment back to NYO. 8/22/2019 of 18) NYC023586 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683659  UNCLASSIFIEDHFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 18 Physical Status Challenges Lawful Time in Process Location Access HQQ019608 — Hard Drive 1B10 OTD - COMPLETE N/A N/A Started: - Seagate Barracuda ECU 8/22/2019 — Confirmed clone 1830 8/16/2019 500GB HDD, (HQQ019627). Forensic Image on NYO OpWan. ST350032ONS, S/N No further processing required. Item returned Completed: 9QM8MSEZ (DVR2 - 10 of to OTD ECU pending shipment back to NYO. 8/22/2019 18) NYCO23587 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019611 — Hard Drive 1811 OTD - COMPLETE N/A N/A Started: - Seagate Constellation ES ECU 8/22/2019 — Confirmed clone 1831 8/16/2019 500GB HDD, (H00019628). Forensic Image on NYO OpWan. ST5OONM0011, S/N No further processing required. Item returned Completed: Z1M1PX26 (DVR2 — 11 of to OTD ECU pending shipment back to NYO. 8/22/2019 18) NYCO23588 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683660  UNCLASSIFIEDRFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019612 — Hard Drive 1B12 OTD - COMPLETE N/A N/A Started: - Seagate Constellation ES DFAU 8/22/2019 — Confirmed clone 1832 8/16/2019 500GB HDD, (H00019629). Forensic Image on NYO Op Wan. STSOONM0011, S/N No further processing required. Item returned Completed: Z1M1Q1FX (DVR2 —12 of to OTD ECU pending shipment back to NYO. 8/22/2019 18) NYCO23589 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019613 — Hard Drive 1B13 OTD - COMPLETE Damaged N/A Started: - Western Digital 500GB DFAU 8/22/2019 — 100% acquired. Forensic Image 8/16/2019 HDD, WD5000AVDS- made to DFAU OpWan. Clone being created 63U7B1, S/N and turned over to Examiner. Completed: WCAV9T870016 (DVR2 - 8/22/2019 13 of 18) NYCO23590 8/19/2019 — Damaged heads. DFAU performed head stack swap, data is slowly imaging. 97% complete. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683661  UNCLASSIFIED//FOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 16 Physical Status Challenges Lawful Time in Process Location Access HQQ019614 —Hard Drive 1B14 OTD - COMPLETE Damaged N/A Started: - Western Digital 500GB DFAU 8/22/2019 — Imaged to DFAU OpWan. Clone 8/16/2019 HDD, WD5000AAKX- created (HQQ) and turned over examiner. 60U6AAO, S/N Completed: WCC2E0DE83YK (DVR2 - 8/21/2019 — Repairs Completed, data 8/22/2019 14 of 18) NYCO23591 recovered, multiple bad sectors. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. Pending delivery of donor parts for repair. 8/15/2019 - Collected, in evidence control pending shipment to OTD. H00019615 — Hard Drive IBIS OTD - COMPLETE N/A N/A Started: - Seagate Barracuda ECU 8/22/2019 — Confirmed clone 1833 8/16/2019 500GB HDD, (HQQ019630). Forensic Image on NYO OpWan. ST350032ONS, S/N No further processing required. Item returned Completed: 9QM8MT6D (DVR2 — 15 to OTD ECU pending shipment back to NYO. 8/22/2019 of 18) NYCO23592 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683662  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 16 Physical Status Challenges Lawful Time in Process Location Access HQQ019616 — Hard Drive 1B16 OTD - COMPLETE N/A N/A Started: - Seagate Constellation ES ECU 8/22/2019 — Confirmed clone 1834 8/16/2019 500GB HDD, (HQQ019631). Forensic Image on NYO OpWan. STSOONM0011, S/N No further processing required. Item returned Completed: Z1M1PZ07 (DVR2 —16 of to OTD ECU pending shipment back to NYO. 8/22/2019 18) NYCO23593 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019617 — Hard Drive 1B17 OTD - COMPLETE Damaged N/A Started: - Seagate Constellation ES DFAU 8/22/2019 — Forensic Image completed to DFAU 8/16/2019 500GB HDD, OpWan. Clone created (H00019354) and ST500NM0011, S/N turned over to examiner. Completed: Z1M1LOYG (DVR2 — 17 of 8/22/2019 18) NYCO23594, Former 8/19/2019 — DFAU reports 100% data recovery, Bay 9 Drive device is currently imaging. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683663  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019618 — Hard Drive 1B18 OTD - COMPLETE Damaged N/A S/tarted: - Seagate Barracuda DFAU 8/22/2019 — Forensic Image Completed to DFAU 8/16/2019 500GB HDD, OpWan. Clone created(HQQ019355) and ST350032ONS, S/N turned over to examiner. Completed: 9QM8MSRR (DVR2 - 18 8/22/2019 of 18) NYCO23595, 8/19/2019 — DFAU reports partial data recovery Former Bay 14 Drive (44 bad sectors not recovered), device is imaging. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019595 — Disk Array 1B19 OTD - 8/16/2019 — Chassis for inoperable DVR2 N/A N/A Started: Chassis; Nice Systems DFAU arrived at OTD. Drives removed prior to arrival 8/16/2019 Model#: SA-66405, SN: at OTD F96168201-004 (DVR2) HQQ019596 - Disk Array 1619 OTD - 8/16/2019 — Controller for inoperable DVR2 N/A N/A Started: Controller; NICE Systems DFAU arrived at OTD. Contains 2 Drives 8/16/2019 Model#: NP-2000, SN: 43144902 (DVR2) UNCLASSIFIED//FOUO EFTA01683664  UNCLASSIFIED//FOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019331 — Hard Drive 1B19 OTD - COMPLETE N/A N/A Started: — Seagate Model#: ECU 8/22/2019 - No further processing required. 8/16/2019 ST3320620AV, SN: Item returned to OTD ECU pending shipment 9QFCN325, 320GB (Top back to NYO. Completed: Drive of HQQ019596 - 8/22/2019 Disk Array Controller) 8/19/2019 — Clone created (HQQ019332) and imaged to DFAU OpWan. 8/16/2019 — Top Hard drive for HQQ019596 - Disk Array Controller arrived at OTD HQQ019332 — Hard Drive none OTD — 08/21/2019 — Created by examiner for use in N/A N/A Started: - Western Digital, 320GB, DFAU disk array. 8/21/2019 Model#: WD3200JB, SN: WCAMR1020769 H00019594 1B20 OTD - 8/22/2019 - Contains 2 drives Bay 1(HQQ) and TBD TBD Started: — DVR Controller - Dell DFAU Bay 2(HQQ). Drives Imaged to DFAU OpWan 8/16/2019 PowerEdge R420 DVR and clones created (HQQ) Controller, Barcode# SBMQZ12, Express service 8/16/2019 — DVR controller for operable DVR1 Code #: 11587249622, arrived at OTD. Manufacturer date: 20140829 (DVR1) UNCLASSIFIED//FOUO EFTA01683665  UNCLASSIFIEDHFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 16 Physical Status Challenges Lawful Time in Process Location Access HQQ019597 — DVR 1B21 OTD - 8/22/2019 — Drives being labeled with HQQ TBD N/A Started: System - Disk Array DFAU identifiers, imaged and cloned. 8/16/2019 Chassis containing 16 hard Drives; Model#: 8/16/2019 — Operable DVR1 system arrived at Premium 8600, SN: OTD. 16 Drives 232476 HQQ019598 - Disk Array 1621 OTD - 8/16/2019 — Operable DVR1 system arrived at TBD N/A Started: Controller; Model#: NP- DFAU OTD. Contains 2 drives: 1 damaged, 1 8/16/2019 2000, SN: 43144901 functional. Drives given HQQ identifiers, (DVR1) imaged and cloned. HQQ0I8525 — Hard drive 1B21 OTD — COMPLETE Damaged N/A Started: — Maxtor DiamondMax DFAU 8/22/2019 — Drive imaged and Cloned(HQQ) 8/16/2019 10, 80GB, Model#: and Clone turned over to examiner. 6L080P0, SN: L25C8D3G, Completed: Top Drive 8/21/2019 — Damaged hard drive repaired, data 8/22/2019 is being recovered (10 bad sectors). 8/16/2019 — Arrived at OTD as part of 1621. Top Drive (1of 2) HQQ018526 — Hard Drive 1621 OTD - 8/16/2019 — Arrived at OTD as part of 1621. N/A N/A Started: - Maxtor DiamondMax DFAU Bottom Drive (2 of 2) 8/16/2019 10, 80GB, Model#: 6L080P0, SN: L25CF5QG, Bottom Drive UNCLASSIFIED//FOUO EFTA01683666  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access 1622 —1836 — Derivative 1B22 OTD - 8/21/2019 — Arrived at QT on 8/20, in process N/A N/A Started: Evidence —14 Hard Drives DFAU with DFAU. 8/20/2019 containing clone copies of multiple Hard Drives from 8/20/2019 — Drives delivered to OTD. DVR2. 8/19/2019 — Derivative evidence — clone copies of hard drives removed from DVR2. Collected by DFAU UC Petronella to be delivered to OTD on 8/20/2019 1B40 — Hard Drive - One 1B40 NY CART COMPLETE N/A N/A N/A (1) Seagate 500GB hard 8/22/2019 — Item not at OTD. Nothing further drive, serial number to report. W2AEXS1V, containing video downloaded from 8/19/2019 — Copy of all video available for DVR1 at MCC download for 8/10/2019, All relevant video from Special Housing Unit floor 9 and Attorney Visit area floor 3 from 7/23 to 8/10/2019, All video available to download for 8/9 (THIS DOWNLOAD FAILED) and video downloaded by tech, (that is the wrong camera). UNCLASSIFIED//FOUO EFTA01683667