EFTA01683629.pdf

• UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) UNSUB; JEFFREY EPSTEIN — VICTIM; DEATH INVESTIGATION Digital Evidence Tracking (U//FOUO) Executive Summary: The New York Division (NY) initiated a death investigation for the apparent suicide of Jeffrey EPSTEIN at the Metropolitan Correctional Center (MCC) which occurred on 10 August 2019. On 12 August 2019, OTD was contacted by the NY Division for assistance with a MCC video surveillance system consisting of two Digital Video Recorders (DVR1 - operational and DVR2 — not operational) and a controller. The NY Division Computer Analysis Response Team (NY CART) has collected digital evidence items associated with this investigation. OTD is currently tracking 37 digital evidence items (associated with DVR1 and DVR2): (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019599 - Hard 1B1 OTD - 8/22/2019 — Confirmed clone 1B22 N/A N/A Started: Drive — Seagate ECU (HQQ019619). Forensic Image on NYO OpWan. 8/16/2019 Barracuda 5000B No further processing required. Item returned HDD, STSOODM002, to OTD ECU pending shipment back to NYO. Completed: S/N Z3T6CJJA (DVR2 — 8/22/2019 1 of 18) NYCO23578 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683629  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 18 Physical Status Challenges Lawful Time in Process Location Access HQQ019600 - Hard 182 OTD - 8/22/2019 — Confirmed clone 1823 N/A N/A Started: Drive — Hitachi 500GB ECU (HQQ019620). Forensic Image on NYO OpWan. 8/16/2019 HDD, No further processing required. Item returned HD5721050CLA662, to OTD ECU pending shipment back to NYO. Completed: S/N JP1572JE36A13K 8/22/2019 (OVR2 — 2 of 18) 8/16/2019 — Device arrived at OTD. NYCO23579 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019601 — Hard 183 OTD - 8/22/2019 - Confirmed clone 1824 N/A N/A Started: Drive — Seagate ECU (H00019621). Forensic Image on NYO OpWan. 8/16/2019 Barracuda 500GB No further processing required. Item returned HDD, STSOODM002, to OTD ECU pending shipment back to NYO. Completed: S/N Z3T6CF5X (DVR2 — 8/22/2019 3 of 18) NYCO23580 8/16/2019 — Device arrived at OTD. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683630  UNCLASSIFIEDHFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 16 Physical Status Challenges Lawful Time in Process Location Access HQQ019602 — Hard 1B4 OTD - 8/22/2019 — Confirmed clone 1B25 N/A N/A Started: Drive — Seagate ECU (HQQ019622). Forensic Image on NYO OpWan. 8/16/2019 Barracuda 500GB No further processing required. Item returned HDD, ST350032ONS, to OTD ECU pending shipment back to NYO. Completed: S/N 9QM8MT9P 8/22/2019 (DVR2 4 of 18) 8/16/2019 — Device arrived at OTD. NYCO23581 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019603 — Hard 1B5 OTD - 8/22/2019 — Data recovery XX% completed Damaged N/A Started: Drive — Hitachi 500GB DFAU 8/16/2019 HDD, 8/21/2019 — Repaired, data is being recovered — HDS721050CLA662, 26% complete. S/N: JP1572JE36MWNK 8/16/2019 — Device arrived at OTD. Data (DVR2 — 5 of 18) Recovery Program assessment ongoing. NYCO23582 Pending delivery of donor parts for repair. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683631  UNCLASSIFIEDRFOU0 Operational Technology Division Countering Threats Through Technology (UHFOU0) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019604 — Hard 1B6 OTD - 8/22/2019 — Confirmed clone 1826 N/A N/A Started: Drive — Seagate ECU (HQQ019623). Forensic Image on NYO OpWan. 8/16/2019 Barracuda 500GB No further processing required. Item returned HDD, ST3500320N5, to OTD ECU pending shipment back to NYO. Completed: S/N 9QM8EC75 (DVR2 8/22/2019 - 6 of 18) NYCO23583 8/16/2019 — Device arrived at OTD 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019605 — Hard 187 OTD - 8/22/2019 - Confirmed clone 1827 N/A N/A Started: Drive — Seagate ECU (H00019624). Forensic Image on NYO OpWan. 8/16/2019 Constellation ES No further processing required. Item returned 500OB HDD, to OTD ECU pending shipment back to NYO. Completed: STSOONM0011, S/N 8/22/2019 Z1M1PZPE (DVR2 — 7 8/16/2019 — Device arrived at OTD. of 18) NYCO23584 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683632  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (UHFOU0) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019606 — Hard 1B8 OTD - 8/22/2019 — Confirmed clone 1828 N/A N/A Started: Drive - Western ECU (HQQ019625). Forensic Image on NYO OpWan. 8/16/2019 Digital 500GB HDD, No further processing required. Item returned WD5000AVDS- to OTD ECU pending shipment back to NYO. Completed: 63U7B1, S/N 8/22/2019 WCAV9Z911026 8/16/2019 — Device arrived at OTD. (DVR2 — 8 of 18) NYCO23585 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019607 — Hard 189 OTD - 8/22/2019 - Confirmed clone 1829 N/A N/A Started: Drive - Western ECU (H00019626). Forensic Image on NYO OpWan. 8/16/2019 Digital 500GB HDD, No further processing required. Item returned WD5000AAKX- to OTD ECU pending shipment back to NYO. Completed: 60U6AAO, S/N 8/22/2019 WCC2EJUC34CJ (DVR2 8/16/2019 — Device arrived at OTD. —9 of 18) NYCO23586 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683633  UNCLASSIFIEDHFOUO Operational Technology Division Countering Threats Through Technology (UHFOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 18 Physical Status Challenges Lawful Time in Process Location Access HQQ019608 — Hard 11310 OTD - 8/22/2019 — Confirmed clone 1830 N/A N/A Started: Drive - Seagate ECU (HQQ019627). Forensic Image on NYO OpWan. 8/16/2019 Barracuda 500GB No further processing required. Item returned HDD, ST3500320NS, to OTD ECU pending shipment back to NYO. Completed: S/N 9QM8MSEZ 8/22/2019 (DVR2 - 10 of 18) 8/16/2019 — Device arrived at OTD. NYC023587 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019611 — Hard 1811 OTD - 8/22/2019 - Confirmed clone 1831 N/A N/A Started: Drive - Seagate ECU (HOO019628). Forensic Image on NYO OpWan. 8/16/2019 Constellation ES No further processing required. Item returned 500GB HDD, to OTD ECU pending shipment back to NYO. Completed: ST500NM0011, S/N 8/22/2019 Z1M1PX26 (DVR2 - 11 8/16/2019 — Device arrived at OTD. of 18) NYC023588 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683634  UNCLASSIFIEDRFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 18 Physical Status Challenges Lawful Time in Process Location Access HQQ019612 — Hard 1612 OTD - 8/22/2019 — Confirmed clone 1832 N/A N/A Started: Drive - Seagate DFAU (HQQ019629). Forensic Image on NYO Op Wan. 8/16/2019 Constellation ES No further processing required. Item returned 500GB HDD, to OTD ECU pending shipment back to NYO. Completed: ST5OONM0011, S/N 8/22/2019 Z1M1Q1FX (DVR2 - 8/16/2019 — Device arrived at OTD. 12 of 18) NYCO23589 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019613 — Hard 1B13 OTD - 8/22/2019 - Damaged N/A Started: Drive - Western DFAU 8/16/2019 Digital 500GB HDD, 8/19/2019 — Damaged heads. DFAU performed WDS000AVDS- head stack swap, data is slowly imaging. 97% 63U761, S/N complete. WCAV9T870016 (DVR2 — 13 of 18) 8/16/2019 — Device arrived at OTD. Data NYCO23590 Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683635  UNCLASSIFIEDRFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019614 —Hard 1B14 OTD - 8/22/2019 - Damaged N/A Started: Drive - Western DFAU 8/16/2019 Digital SOOGB HDD, 8/21/2019 — Repairs Completed, data WD5000AAKX- recovered, multiple bad sectors. 60U6AAO, S/N WCC2EODE83YK 8/16/2019 — Device arrived at OTD. Data (DVR2 — 14 of 18) Recovery Program assessment ongoing. NYCO23591 Pending delivery of donor parts for repair. 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019615 — Hard 1815 OTD - 8/22/2019 — Confirmed clone 1B33 N/A N/A Started: Drive - Seagate ECU (HQQ019630). Forensic Image on NYO OpWan. 8/16/2019 Barracuda 500GB No further processing required. Item returned HDD, 51-3500320M, to OTD ECU pending shipment back to NYO. Completed: S/N 9QM8MT6D 8/22/2019 (DVR2 — 15 of 18) 8/16/2019 — Device arrived at OTD. NYCO23592 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683636  UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 16 Physical Status Challenges Lawful Time in Process Location Access HQQ019616 — Hard 1B16 OTD - 8/22/2019 — Confirmed clone 1634 N/A N/A Started: Drive - Seagate ECU (HOO019631). Forensic Image on NYO Op Wan. 8/16/2019 Constellation ES No further processing required. Item returned 500GB HDD, to OTD ECU pending shipment back to NYO. Completed: ST500NM0011, S/N 8/22/2019 Z1M1PZ07 (DVR2 -16 8/16/2019 — Device arrived at OTD. of 18) NYC023593 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019617 — Hard 1B17 OTD - 8/19/2019 — DFAU reports 100% data recovery, Damaged N/A Started: Drive - Seagate DFAU device is currently imaging. 8/16/2019 Constellation ES 500GB HDD, 8/16/2019 — Device arrived at OTD. Data ST500NM0011, S/N Recovery Program assessment ongoing. Z1M1L0YG (DVR2 - 17 of 18) NYC023594 8/15/2019 - Collected, in evidence control pending shipment to OTD. HQQ019618 — Hard 1B18 OTD - 8/19/2019 — DFAU reports partial data recovery Damaged N/A Started: Drive - Seagate DFAU (44 bad sectors not recovered), device is 8/16/2019 Barracuda 500GB imaging. HDD, ST3500320NS, S/N 9QM8MSRR 8/16/2019 — Device arrived at OTD. Data (DVR2 — 18 of 18) Recovery Program assessment ongoing. NYC023595 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA01683637  UNCLASSIFIED/IFOU0 Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access HQQ019595 — Disk 1819 OTD - 8/16/2019 — Chassis for inoperable DVR2 N/A N/A Started: Array Chassis; Nice DFAU arrived at OTD. Drives removed prior to arrival 8/16/2019 Systems Model#: SA- at OTD 6640S, SN: F96168201-004 (DVR2) HQQ019596 - Disk 1819 OTD - 8/16/2019 — Controller for inoperable DVR2 N/A N/A Started: Array Controller; NICE DFAU arrived at OM. Contains 2 Drives 8/16/2019 Systems Model#: NP- 2000, SN: 43144902 (DVR2) HQQ019331 — Hard 1819 OTD - 8/22/2019 - No further processing required. N/A N/A Started: Drive —Seagate ECU Item returned to OTD ECU pending shipment 8/16/2019 Model#: back to NYO. ST3320620AV, SN: Completed: 9QFCN325, 32068 8/19/2019 — Clone created (HQQ019332) and 8/22/2019 (Top Drive of imaged to DFAU OpWan. HQQ019596 - Disk Array Controller) 8/16/2019 — Top Hard drive for HQQ019596 - Disk Array Controller arrived at OTD HQQ019332 — Hard 08/21/2019 — Created by examiner for use in N/A N/A Drive - Western disk array. Digital, 320GB, Model#: WD3200JB, SN: WCAMR1020769 UNCLASSIFIED//FOUO EFTA01683638  UNCLASSIFIED//F0UO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 1B Physical Status Challenges Lawful Time in Process Location Access 1B20 - DVR OTD - 8/16/2019 — DVR controller for operable DVR1 TBD TBD Started: Controller - Dell DFAU arrived at OTD. 8/16/2019 PowerEdge R420 DVR Controller, Barcode# SBMQZ12, Express service Code ti: 11587249622, Manufacturer date: 20140829 (DVR1) 1621— DVR System - OTD - 8/16/2019 — Operable DVR1 system arrived at TBD TBD Started: Disk Array Chassis DFAU OTD. 8/16/2019 containing 16 hard Drives; Model#: Premium 8600, SN: 232476 and Disk Array Controller; Model#: NP-2000, SN: 43144901 (DVR1) UNCLASSIFIED//FOUO EFTA01683639  UNCLASSIFIEDHFOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 22 August 2019 1400 Description 16 Physical Status Challenges Lawful Time in Process Location Access 1822 —1836 - OTD - 8/21/2019 — Arrived at QT on 8/20, in process N/A N/A TBD Derivative Evidence - DFAU with DFAU. 14 Hard Drives containing clone 8/20/2019 — Drives delivered to OTD. copies of multiple Hard Drives from 8/19/2019 — Derivative evidence — clone copies DVR2. of hard drives removed from DVR2. Collected by DFAU UC Petronella to be delivered to OTD on 8/20/2019 1340 — Hard Drive - NY CART 8/19/2019 — Copy of all video available for N/A N/A N/A One (1) Seagate download for 8/10/2019, All relevant video 500GB hard drive, from Special Housing Unit floor 9 and Attorney serial number Visit area floor 3 from 7/23 to 8/10/2019, All W2AEXSJV, containing video available to download for 8/9 (THIS video downloaded DOWNLOAD FAILED) and video downloaded by from DVR1 at MCC tech, (that is the wrong camera). No 18 — Hard drive OTD - 8/21/2019 — Damaged hard drive repaired, data Damaged N/A Started: containing video DFAU is being recovered (10 bad sectors). 8/19/2019 footage, HQQ0I8525 UNCLASSIFIED//FOUO EFTA01683640