EFTA00157074.pdf

Date: Fri. 23 Aug 2019 8:27:32 PM (UTC) Subject: Assistance request UNCLASSIFIED From: To: Classification: UNCLASSIFIED Indicates required information. I. (U) Service Requested 1.1 •Identification of requested support • The New York Field Office requests an examination to decrypt Filevault II full disk encryption found on submitted hard drive 1.2 *Due to the high profile nature of the case, high priority is requested 2. (U) Legal Authority 2.1 •Proof of legal authority (Include copy in IA package or reference document serial) • Pursuant to search warrant issued by the Southern District of New York on July I I, 2019. A copy of the search warrant is included in the IA package of this communication. 3. (U) Device Identification 3.1 •Identification of device(s) to be analyzed • Submitted is an image file of a I TB Seagate external HDD SM: NA98Z5WD designated as NYC024338, I B56. 4. (U) Brief Synopsis/Background of Case Southern District of New York contacted C-20 regarding several victims that had been sexually abused by JEFFREY EPSTEIN in the mid 2000's. EPSTEIN invited minors into his residences, one of which was located in Manhattan, and paid them to provide massages to him which turned sexual in nature. 5.(U) Previous Analysis/Status of Computer Hard drive 5.1 *Characterization of any previously conducted analysis Item was imaged and found to be filevault 11 encrypted via the TX I disk duplicator. 5.2 *Status of Computer: locked, unlocked, or unknown. Also include password or potential passwords gleaned through other investigative methods 3503-006 Page I of 2 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001889 EFTA00157074 No passwords or potential passwords have been discovered to date. 5.3 *If device is not considered evidence, state this clearly The device is evidence in the above captioned case. 6. (U) POC/Special Handling of Evidence 6.1 *Requestor's point-of-contact information, supporting CART examiner, and special handling of evidence Point of contact is CART Senior examiner ethe NY Field office. Image is currently available for exploitation on OPWAN. NW CART Coordinator Classification: UNCLASSIFIED 3503-006 Page 2 of 2 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001890 EFTA00157075