EFTA00142362.pdf

IS-I Me% 0b15.2017) UNCLASSIFIED REPORT OF EXAMINATION Federal Bureau of Investigation Digital Evidence Laboratory To: New York SA IMF IMMI Request Date: Ref. No: Title: August 16, 2019 Serial 58 UNSUB(S); JEFFREY EPSTEIN - VICTIM; DEATH INVESTIGATION Date item(s) received: August 16, 2019 Item(s) submitted: HQQ019594: HQQ019333: HQQ019334: HQQ019595: HQQ019596: HQQ019331: Page 1 of 9 ERF Budding 27958A QUentiCO. VA 22135 Date: June 16, 2021 Case ID: 090A-NY-3151227 Request No.: HQQ190816001 DVR, Dell, PowerEdge R420, SBMQZI2, 1B20, One (1) DVR System Controller (Examined) Hard Drive, Dell, WD5003ABYX-18WERA0, WMAYP0DFPY4F, 1B20, One (1) hard disk drive from Bay I of DVR System Controller. (Examined) Hard Drive, Dell, WD5003ABYX-18WERA0, WMAYP0DNCDAV, 1B20, One (1) hard disk drive from Bay 2 of DVR System Controller. (Examined) DVR, NICE Systems, SA-6640S, F96168201-004, 1B19, One (1) DVR Disk Array (DVR 2) (Examined) DVR, NICE Systems, Nicevision PRO (NP-2000), 43144902, 1B19, One (1) DVR Disk Array Controller (DVR 2) (Examined) Hard Drive, Seagate, ST3320620AV, 9QFCN325, 1B19, One (1) hard disk UNCLASSIFIED An Accredited Laboratory Since January 16, 2007 EFTA00142362 UNCLASSIFIED HQQ019597: HQQ018772: HQQ018773: HQQ018774: HQQ018775: HQQ018776: HQQ018777: HQQ018778: HQQ018779: HQQ018780: HQQ018781: HQQ018782: HQQ018783: HQQ018784: HQQ018785: HQQ018786: HQQ018787: HQQ019598: HQQ190816001 090A-NY-3 151227 Page 2 of 9 drive from top bay of DVR 2 Disk Array Controller. (Examined) DVR, NICE Systems, Premium 8600, 232476, 1B21, One (1) DVR Disk Array (DVR 1) (Examined) Hard Drive, Western Digital, WD3200AAJB, WCAV21723809, From Bay 1 of HQQ019597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QF7PFHZ, From Bay 2 of HQQ019597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QF7P84L, Drive from Bay 3 of HQQ019597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QFCM8PR, From Bay 4 of HQQ0 19597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QF649J4, From Bay 5 of HQQ0 19597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QF7NJTG, From Bay 6 of HQQ0 19597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QFB0S6N, From Bay 7 of HQQ0 19597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QFB0P1Q, From Bay 8 of HQQ0 19597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QF7P8W1, From Bay 9 of HQQ0 19597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QF7PFPY, Bay 10 of HQQ0 19597 pcarnined) Hard Drive, Seagate, ST3320620AV, 9QFCM7CS, From Bay 11 of HQQ019597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QF9Q0F5, From Bay 12 of HQQ0 19597 (Examined) Hard Drive, Maxtor, MaXLine II, A830RYBE, Drive from Bay 13 (Examined) Hard Drive, Western Digital, WD3200AAJB-00J3A0, WCAV21023754, From Bay 14 of HQQ019597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QFCJV3P, Bay 15 of HQQ0 19597 (Examined) Hard Drive, Seagate, ST3320620AV, 9QF7N0SX, From Bay 16 of HQQ0 19597 (Examined) DVR, NICE Systems, Nicevision PRO (NP-2000), 43144901, 1B21, One (1) UNCLASSIFIED EFTA00142363 UNCLASSIFIED HQQ018525: HQQ018526: HQQ019599: HQQ019600: HQQ019601: HQQ019602: HQQ019603: HQQ019604: HQQ019605: HQQ019606: HQQ019607: HQQ019608: HQQ019609: HQQ019610: HQQ01961I: HQQ019612: HQQ019613: HQQ190816001 090A-NY-3151227 Page 3 of 9 DVR Disk Array Controller (DVR 1) (Examined) Hard Drive, Maxtor, DiamondMax 10 (6L080P0), L25C8D3G, 1B21, One (1) hard disk drive from top bay of DVR 1 Disk Array Controller. (Examined) Hard Drive, Maxtor, DiamondMax 10 (6L080P0), L25CF5QG, 1821, One (1) hard disk drive from bottom bay of DVR 1 Disk Array Controller. (Examined) Hard Drive, Seagate, ST500DM002, Z3T6C.JJA, 1BI, One (1) hard drive (E6516194) (Examined) Hard Drive, Hitachi, HDS721050CLA662, JP1572.1E36A13K, 182, One (I) hard drive (E6516195) (Examined) Hard Drive, Seagate, ST500DM002, Z3T6CF5X, 183, One (1) hard drive (E6516196) (Examined) Hard Drive, Seagate, ST3500320NS, 9QM8MT9P, 1134, One (1) hard drive (E6516197) (Examined) Hard Drive, Hitachi, HDS721050CLA662, JP1572JE36MWNK, 1B5, One (1) hard drive (E6516198) (Examined) Hard Drive, Seagate, ST3500320NS, 9QM8EC75, 1B6, One (1) hard drive (86516199) (Examined) Hard Drive, Seagate, ST500NM0011, Z1M1PZPE, 1B7, One (1) hard drive (E6516200) (Examined) Hard Drive, Western Digital, WD5000AVDS, WCAV9Z911026, 188, One (1) hard drive (E6516201) (Examined) Hard Drive, Western Digital, WD5000AAKX, WCC2EJUC34CJ, 1B9, One (1) hard drive (86516202) (Examined) Hard Drive, Seagate, ST3500320NS, 9QM8MSEZ, 1810, One (1) hard drive (E6516203) (Examined) Hard Drive, Seagate, ST3500641A, 3PO00Q5E, Partial image of DVR 2 system drive (Examined) CD-R, Photos of bad drives. (Examined). Hard Drive, Seagate, ST500NM0011, Z1M1PX26, 1811, One (1) hard drive (E6516204) (Examined) Hard Drive, Seagate, ST500NM0011, ZIMIQIFX, 1812, One (1) hard drive (E6516205) (Examined) Hard Drive, Western Digital, WD5000AVDS, WCAV9T870016, 1813, One (1) hard drive (86516206) (Examined) UNCLASSIFIED EFTA00142364 UNCLASSIFIED HQQ019614: Hard Drive, Western Digital, WD5000AAKX, WCC2E0DE83YK, 1B14, One (1) hard drive (E6516207) (Examined) HQQ0I9615: Hard Drive, Seagate, ST3500320NS, 9QM8MT6D, 1B15, One (1) hard drive (E6516208) (Examined) 11QQ019616: Hard Drive, Seagate, ST500NM0011, Z1M1PZ07, 1B16, One (1) hard drive (E6516209) (Examined) HQQ019617: Hard Drive, Seagate, ST500NM0011, Z1M1L0YG, 1B17, One (1) hard drive (E6516210) (Examined) HQQ019618: Hard Drive, Seagate, ST3500320NS, 9QM8MSRR, 1B18, One (1) hard drive (E6516211) (Examined) HQQ019619: Hard Drive, Seagate, ST1000DM003, S1D85PLA, 1B22, Clone of 1B1 (E6515200) (Examined) HQQ019620: Hard Drive, Hitachi, HUA722010CLA330, N039F71 T 1B23, Clone of IB2 (E6515201) (Examined) HQQ019621: Hard Drive, Seagate, ST1000DM003, Z1D3ZSS0, IB24, Clone of 1B3 (E6515202) (Examined) HQQ019622: Hard Drive, Seagate, ST1000DM003, Z4YDJL1T, 1B25, Clone of 1B4 (E6515203) (Examined) HQQ019623: Hard Drive, Seagate, ST1000DM003, Z4YDHX5M, 1B26, Clone of 1B6 (E6515204) (Examined) HQQ019624: Hard Drive, Seagate, ST1000DM003, W1D48YH6, 1B27, Clone of 1B7 (E6515205) (Examined) HQQ019625: Hard Drive, Western Digital, WD10EADS, WCAU45803950, 1B28, Clone of 1B8 (E6515206) (Examined) HQQ019626: Hard Drive, Seagate, STI000DM003, Z4Y00Q48, 1B29, Clone of 1B9 (E6515207) (Examined) HQQ019627: Hard Drive, Seagate, ST1000DM003, W1D496N0, 1B30, Clone of 1B10 (E6516228) (Examined) HQQ019628: Hard Drive, Seagate, STI000DM003, Z1DB25CT, 1B31, Clone of 1B11 (E6516229) (Examined) HQQ019629: Hard Drive, Seagate, ST1000DM003, W1D48Z6E, 1B32, Clone of 1B12 (E6516230) (Examined) HQQ019630: Hard Drive, Western Digital, WD1003FZEX, WCC3F2783519, IB33, Clone of IBIS (E651623 I) (Examined) HQQ019631: Hard Drive, Seagate, ST1000DM003, S1D9GK9P, 1B34, Clone of 1B16 HQQ190816001 090A-NY-3 151227 Page 4 of 9 UNCLASSIFIED EFTA00142365 UNCLASSIFIED (E6516232) (Examined) HQQ019632: Hard Drive, Seagate, ST1000DM003, S1D9DETC, (E6516233) (Examined) HQQ019633: Hard Drive, Seagate, STI000DM003, W1D06T5L, (E6516234) (Examined) 1B35, Clone of 1B17 1B36, Clone of 1B18 Summary: Per Electronic Communication (EC) dated 8/26/2019, Special Agent (SA) a transferred the submitted specimens from the New York field office to the Operational Technology Division/Digital Forensics Analysis Unit (OTD/DFAU) in Quantico for examination. The specimens were received by the Computer Analysis Response Team (CART) for analysis. Per discussion with CART Laboratory Supervisor MM on 8/19/2019, the Digital Video Recorder (DVR) system is to be assembled to allow export of videos contained on the system. The DVR system consisted of a main controller and 2 disk arrays, labeled as DVR 1 and DVR 2. DVR 1 was assembled successfully and made available for export of videos. Video Specialist performed exports based on requests made by the NY investigative team. On 12/19/2019, DVR 1 failed due to hardware issues. Contact with the vendor and attempts to use replacement parts were unsuccessful in restoring the disk array to a usable state. DVR 2 contained 3 hard disk drives that were repaired by Advanced Data Recovery Specialist M . However, DVR 2 was never able to be assembled successfully. A review of the logs on the DVR 2 controller indicated catastrophic disk failures before receipt by the FBI. A master copy of the images of the hard disk drives contained in the DVR system were placed on to 3 hard drives for storage (labeled as HQQ026637-HQQ026639). Details of Examination: The dates of this examination were August 20, 2019 through May 24, 2021. HQQ190816001 090A-NY-3151227 Page 5 of 9 UNCLASSIFIED EFTA00142366 UNCLASSIFIED The submitted items were parts of a DVR system, overview as follows: 1B# AQQ# Item Contents 1820 ' HQQ019594 in Controller Contained 2 drives 11321 (2 of 2) HQQ019598 DVR 1 Controller 1B21 (1 of 2) HQQ019597 DVR 1 Disk Array Contained 2 drives Contained 16 drives 1B19 (2 oft) 1B19 (1 oft) HQQ019596 DVR 2 Controller HQQ019595 IDVR 2 Disk Array Array is empty Contained 1 drive The hard disk drives contained in the units were write blocked and forensic images created as follows: Main Controller - Forensic images of the 2 drives were created to a forensically clean network share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by FE as. DVR 1 Controller - The top bay drive was repaired by Recovery Specialist a. Forensic images of the 2 drives were created to a forensically clean network share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by FE as. DVR 1 Disk Array - Forensic images of the 16 drives were created to a forensically clean network share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by FE a. DVR 2 Controller - Forensic image of the 1 drive was created to a forensically clean network share in Quantico for archive. A forensic copy of the drive (clone) was also created on an additional physical drive to be used in the unit for assembly. These actions were performed by FE -. DVR 2 Disk Array - The 16 drives originally contained in the unit were provided to the NY FO. Forensic images of the 16 drives were created to a forensically clean network share in New York for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by NY FE's and provided to the CART team in Quantico. The DVR system was assembled using the clones and powered on. The Main Controller started up successfully and was accessed using Administrator password "!Nicelog" as provided by the vendor. The NICE suite of software, which provides visibility into the HQQ190816001 090A-NY-3151227 Page 6 of 9 UNCLASSIFIED EFTA00142367 UNCLASSIFIED setup and recordings on DVR 1 and DVR 2 was accessed using password "NICE" to gain access to the administrator functions. A review indicated that roughly half of the camera assignments were allotted to each DVR. DVR 1 started up successfully and recordings were available for export through the Main Controller software interface. DVR 2 did not start successfully. On 9/18/2019, a meeting was conducted with DVR vendor Technical Support Representative Mk of SigNet Technologies. Houston provided an overview of the o tion of the system. A review of the DVR 2 controller logs by Houston and Senior Advisor I indicated that there had been catastrophic disk failures in the array and no recordings would have been available after 7/29/2019. Loveall and Computer Scientist Mike Beaudin were provided access to the beginning sectors of the 16 drives to see if the structure would indicate clues of a possible rebuild. None were apparent. Video Specialist • was provided access to the DVR software and performed exports of the available recordings on DVR 1 based on investigative team requests. On 12/19/2019, Video Specialist reported beeping from the disk array and inability to use the software to continue to perform exports. A review of the unit indicated memory errors. Attempts at reseating memory board and RAM were unsuccessful. The vendor was contacted for replacement parts, but none were available due to the age of the unit. Lab Supervisor purchased and provided exemplar memory board and RAM. Several attempts to restore the unit to working order with replacement parts were unsuccessful and eventually exhausted. The DVR system original items and clones were returned to NY FO. Master copies of the Main Controller, DVR 1 images, DVR 2 repaired drive images, and video exports were placed on to hard disk drives (HQQ026637-HQQ026639) for storage. NY CART Examiners will perform archive of the DVR 2 images located on the NY FO network share. Derivative Evidence/Copies: HQQ018788: Hard Drive, Western Digital, WD3200AAJB, WCARW3862711, Clone of HQQ018772 Bay 1 HQQ018789: Hard Drive, Western Digital, WD3200AAJB, WCARW4061457, Clone of HQQ018773 Bay 2 HQQ018790: Hard Drive, Western Digital, WD3200AAJB, WCARW4061578, Clone of HQQ018774 Bay 3 HQQ018791: Hard Drive, Western Digital, WD3200AAJB, WCARW3816411, Clone of HQQ018775 Bay 4 HQQ018792: Hard Drive, Western Digital, WD3200AAJB, WCARW3886572, Clone of HQQ190816001 090A-NY-3151227 Page 7 of 9 UNCLASSIFIED EFTA00142368 UNCLASSIFIED HQQ018776 Bay 5 HQQ018793: Hard Drive, Western Digital, WD3200AAJB, WCARW3914931, Clone of HQQO 18777 Bay 6 HQQ018794: I-Iard Drive, Western Digital, WD3200AAJB, WCARW3809038, Clone of HQQ0I8778 Bay 7 HQQ018795: Hard Drive, Western Digital, WD3200AAJB, WCARW4064417, Clone of HQQ0I8779 Bay 8 HQQ018796: Hard Drive, Western Digital, WD3200AAJB, WCARW3816301, Clone of HQQ018780 Bay 9 HQQ018797: Hard Drive, Western Digital, WD3200AAJB, WCARW3915042, Clone of HQQ018781 Bay 10 HQQ018798: Hard Drive, Western Digital, WD3200AAJB, WCARW3809320, Clone of HQQ018782 Bay 11 HQQ018799: Hard Drive, Western Digital, WD3200AAJB, WCARW3816426, Clone of HQQO 18783 Bay 12 HQQ018800: Hard Drive, Western Digital, WD3200AAJB, WCARW3809296, Clone of HQQ018784 from Bay 13 of IIQQ019597 HQQ01880I: Hard Drive, Western Digital, WD3200AAJB, WCARW3809224, Clone of HQQ018785 Bay 14 HQQ018802: Hard Drive, Western Digital, WD3200AAJB, WCARW3755653, Clone of HQQ018786 Bay 15 HQQ018803: Hard Drive, Western Digital, WD3200AAJB, WCARW3816498, Clone of HQQ018787 Bay 16 HQQ019332: Hard Drive, Seagate, ST3500630A, 9QG23RDP, Clone of HQQ019331 (top bay of DVR2 Disk Array Controller) HQQ019335: Hard Drive, Western Digital, WD1001FALS-41Y6A1, WCATR7962678, Clone of HQQO 19333 (Bay 1 of Main Controller) HQQ019336: Hard Drive, Western Digital, WD15EVDS-73V9B1, WMAVU4005952, Clone of HQQ019334 (Bay 2 of Main Controller) HQQ019337: Hard Drive, Maxtor, DiamondMax 6L300R0, L60YGFBG, Clone of HQQ018526 HQQ019353: Hard Drive, Maxtor, 6L200PD, L41RWHTH, Clone of repaired HQQO 18525 HQQ019354: Hard Drive, Seagate, ST3500630AS, 9QG4FNAD, Clone of repaired 1B17 HQQ019355: Hard Drive, Toshiba, dt01aca050, 74J2Z3GAS, Clone of repaired 1B18 HQQ1908 16001 090A-NY-3 151227 Page 8 of 9 UNCLASSIFIED EFTA00142369 UNCLASSIFIED HQQ019356: Hard Drive, Seagate, ST3500410SV, 6VM5VRFN, Clone of repaired 1B14 HQQ019361: Hard Drive, Seagate, ST5OONM0011, ZIM16CCO, Clone of repaired 1B13 HQQ019363: Hard Drive, Seagate. ST5OONM0011, Z1M16CMQ, Clone of repaired 185 HQQ026637: Hard Drive, Western Digital, WD20EARS-22MVWBO, WCAZA6894206, Contains Master Copy of DVR Main Controller images. HQQ026638: Hard Drive, Seagate, ST100000VN0008, ZPWOKE1R, Contains Master Copy of DVR 1 images. HQQ026639: Hard Drive. Western Digital, WD4003FLEX-00Z4SAO, WMC5DOD9K9RO, Contains Master Copy of DVR 2 controller, DVR 2 repaired drive images, and Video Exports. Disposition of Items: All original evidence items and derivative evidence items including Master Copies (HQQ026637- HQQ026639) were submitted to OTD Evidence Control for delivery to the contributing office. No electronic evidence is being retained at DFAU Headquarters. The notes of this examination are being placed in a Digital Evidence Laboratory (DEL) file jacket and being retained in the FBI MD file. Examiner: Operational Technology Division Computer Analysis Response Team Program HQQI90816001 090A-NY-3 151227 Page 9 of 9 UNCLASSIFIED EFTA00142370