EFTA00174637.pdf

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) UNSUB; JEFFREY EPSTEIN — VICTIM; DEATH INVESTIGATION Digital Evidence Tracking (U//FOUO) Executive Summary: The New York Division (NY) initiated a death investigation for the apparent suicide of Jeffrey EPSTEIN at the Metropolitan Correctional Center (MCC) which occurred on 10 August 2019. On 12 August 2019, OTD was contacted by the NY Division for assistance with a MCC video surveillance system consisting of two Digital Video Recorders (DVR1 - operational and DVR2 — not operational) and a controller. The NY Division Computer Analysis Response Team (NY CART) has collected digital evidence items associated with this investigation. OTD is currently tracking 37 digital evidence items (associated with DVR1 and DVR2): (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21 August 2019 1400 Description Physical Location Status Challenges Lawful Access Time in Process 1B1 — Hard Drive — Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CJJA (DVR2 —1 of 18) NYC023578 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 1B2 - Hard Drive — Hitachi 500GB HDD, HD5721050CLA662, S/N JP1572JE36A13K (DVR2 — 2 of 18) NYC023579 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA00174637 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21 August 2019 1400 Description Physical Location Status Challenges Lawful Access Time in Process 1B3 — Hard Drive — Seagate Barracuda 500GB HDD, STSOODM002, S/N Z3T6CF5X (DVR2 — 3 of 18) NYC023580 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 1B4 - Hard Drive — Seagate Barracuda 500GB HDD, ST3500320145, S/N 9QM8MT9P (DVR2 4 of 18) NYC023581 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 1B5 - Hard Drive — Hitachi 500GB HDD, HDS721050CLA662, S/N: JP1572JE36MWNK (DVR2 — 5 of 18) NYC023582 OTD - DFAU 8/21/2019 — Repaired, data is being recovered — 26% complete. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. Pending delivery of donor parts for repair. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged N/A Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA00174638 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21 August 2019 1400 Description Physical Location Status Challenges Lawful Access Time in Process 1B6 — Hard Drive — Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8EC75 (DVR2 — 6 of 18) NYC023583 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. N/A N/A Started: 8/16/2019 1B7 — Hard Drive — Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZPE (DVR2 — 7 of 18) NYC023584 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 1B8 — Hard Drive - Western Digital 500GB HDD, WD5000AVDS- 63U7B1, S/N WCAV9Z911026 (DVR2 - 8 of 18) NYC023585 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA00174639 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items —As of 21 August 2019 1400 Description Physical Location Status Challenges Lawful Access Time in Process 1B9 — Hard Drive - Western Digital 500GB HDD, WD5000AAKX- 60U6AA0, S/N WCC2EJUC34CJ (DVR2 -9 of 18) NYC023586 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 1610- Hard Drive - Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSEZ (DVR2 — 10 of 18) NYC023587 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 1611- Hard Drive - Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PX26 (DVR2 —11 of 18) NYC023588 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 1B12 - Hard Drive - Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1Q1FX (DVR2 — 12 of 18) NYC023589 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA00174640 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21 August 2019 1400 Description Physical Location Status Challenges Lawful Access Time in Process 1B13 — Hard Drive - Western Digital 500GB HDD, WD5000AVDS- 63U7B1, S/N WCAV9T870016 (DVR2 —13 of 18) NYC023590 OTD - DFAU 8/19/2019 — Damaged heads. DFAU performed head stack swap, data is slowly imaging. 97% complete. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged TBD Started: 8/16/2019 1B14 —Hard Drive - Western Digital 500GB HDD, WD5000AAKX- 60U6AA0, S/N WCC2E0DE83YK (DVR2 —14 of 18) NYC023591 OTD - DFAU 8/21/2019 — Repairs underway, data is being recovered. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. Pending delivery of donor parts for repair. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged TBD Started: 8/16/2019 IBIS — Hard Drive - Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MT6D (DVR2 — 15 of 18) NYC023592 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA00174641 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 21 August 2019 1400 Description Physical Location Status Challenges Lawful Access Time in Process 1616— Hard Drive - Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZ07 (DVR2 —16 of 18) NYC023593 OTD - DFAU 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. TBD TBD Started: 8/16/2019 1B17 — Hard Drive - Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1L0YG (DVR2 —17 of 18) NYC023594 OTD - DFAU 8/19/2019 — DFAU reports 100% data recovery, device is currently imaging. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged TBD TBD Started: 8/16/2019 1B18 — Hard Drive- Seagate Barracuda 500GB HDD, ST350032014 S/N 9QM8MSRR (DVR2 - 18 of 18) NYC023595 OTD- DFAU 8/19/2019 — DFAU reports partial data recovery (44 bad sectors not recovered), device is imaging. 8/16/2019 — Device arrived at OTD. Data Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. Damaged Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA00174642 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items —As of 21 August 2019 1400 Description Physical Location Status Challenges Lawful Access Time in Process 1B19 — Disk Array Chassis; Model#: SA- 6640S, SN: F96168201-004 and Disk Array Controller; Model#: NP-2000, SN: 43144902 (DVR2) OTD - DFAU 8/16/2019 — Chassis and controller for inoperable DVR2 arrived at OTD. Data Recovery Program assessment ongoing. TBD TBD Started: 8/16/2019 1B20 - DVR Controller - Dell PowerEdge R420 DVR Controller, Barcode# SBMQZ12, Express service Code #: 11587249622, Manufacturer date: 20140829 (DVR1) OTD - DFAU 8/16/2019 — DVR controller for operable DVR1 arrived at OTD. Data Recovery Program assessment ongoing. TBD TBD Started: 8/16/2019 1B21 — DVR System - Disk Array Chassis containing 16 hard Drives; Model#: Premium 8600, 5N: 232476 and Disk Array Controller; Model#: NP-2000, SN: 43144901 (DVR1) OTD - DFAU 8/16/2019 — Operable DVR1 system arrived at OTD. TBD TBD Started: 8/16/2019 UNCLASSIFIED//FOUO EFTA00174643 UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items —As of 21 August 2019 1400 Description Physical Location Status Challenges Lawful Access Time in Process 1B22 —1B36 — Derivative Evidence — 14 Hard Drives containing clone copies of multiple Hard Drives from DVR2. OTD - DFAU 8/21/2019 — Arrived at QT on 8/20, in process with DFAU. 8/19/2019 — Derivative evidence —clone copies of hard drives removed from DVR2. Collected by DFAU UC Petronella to be delivered to OTD on 8/20/2019 N/A N/A TBD 1B40 — Hard Drive - One (1) Seagate 500GB hard drive, serial number W2AEXSJV, containing video downloaded from DVR1 at MCC NY CART 8/19/2019 - Copy of all video available for download for 8/10/2019, All relevant video from Special Housing Unit floor 9 and Attorney Visit area floor 3 from 7/23 to 8/10/2019, All video available to download for 8/9 (THIS DOWNLOAD FAILED) and video downloaded by tech, (that is the wrong camera). N/A N/A N/A No 1B — Hard drive containing video footage, HQQ0 18525 OTD - DFAU 8/21/2019 — Damaged hard drive repaired, data is being recovered (10 bad sectors). Damaged N/A Started: 8/19/2019 UNCLASSIFIED//FOUO EFTA00174644