U.S. Department of Justice

Office of the Inspector General

REPORT OF FORENSIC EXAMINATION

<table border="1"><tr><td colspan="2">SUBMITTER</td><td>DATE SUBMITTED</td><td>CASE NUMBER</td></tr><tr><td colspan="2">New York Field Office</td><td>August 13, 2019</td><td>2019-010614</td></tr><tr><td>OFFICE CONDUCTING EXAMINATION</td><td>CYBER ID</td><td colspan="2">SUBJECT(S)</td></tr><tr><td>Cyber Investigations Office</td><td>0384</td><td colspan="2">Federal Bureau of Prisons, Metropolitan Correctional Center, New York, NY</td></tr></table>

DIGITAL DEVICE(S) EXAMINED

1. EnCase Forensic Image of a Seagate 500GB hard drive with the serial number Z6E8M349, which was extracted from a BOP owned HP EliteDesk 800, serial number 2UA4381YNJ, BOP barcode 0214 207268. (Device 1)

2. EnCase Forensic Image of a Seagate 500GB hard drive with the serial number Z6E8K1EV, which was extracted from a BOP owned HP EliteDesk 800, serial number 2UA4381YMW, BOP barcode 0214 207270. (Device 2)



Synopsis


On August 13, 2019, U.S. Department of Justice, Office of the Inspector General (OIG), New York Field Office submitted a Digital Forensics Examination Request form seeking analysis of Devices 1 and 2. Carpenter requested a search of Devices 1 and 2 for a timeline of user activity and work product from 8/9/2019 to 8/10/2019. Carpenter arranged for the seizure of Devices 1 and 2 from the Federal Bureau of Prisons (BOP), Metropolitan Correctional Center (MCC) located in New York, NY.

Devices 1 and 2 were located and seized from the MCC’s Special Housing Unit where former inmate David Epstein was housed at the time of his suicide on August 10, 2019. Carpenter requested that CYBER determine user activity and attribution for each device prior to, at the time of, and subsequent to the discovery of Epstein’s body. Carpenter reported that Device 1 had been used by BOP Materials Handler Supervisor Michael Thomas during the relevant time frame, and that Device 2 had been used by BOP Correctional Officer Tova Noel during the same period.

On August 13, 2019, OIG Lead Information Technology Specialis Cyber Investigations Office (CYBER), received the above referenced devices for analysis.

Leonard successfully processed Devices 1 and 2 with CYBER’s forensic tools, and performed a forensic analysis of the devices. The analysis included a thorough review of system and user artifacts, which were used to create a preliminary summary timeline of user activity on each device. Leonard generated an Excel spreadsheet documenting the information, which can be viewed by clicking this link.

SENSITIVE BUT UNCLASSIFIED

<table border="1"><tr><td colspan="2">EXAMINER NAME AND TITLE:</td><td></td><td colspan="2">REVIEWER NAME AND TITLE:</td><td></td></tr><tr><td>SIGNATURE:</td><td></td><td></td><td>SIGNATURE:</td><td></td><td></td></tr></table>

conclusions of the IG. It is the property of the IG and is loaned to your agency; it and its contents are not to be distributed outside of your agency.

EFTA00062274

All documentation related to this forensic request will be retained by CYBER on the Archive Network Attached Storage located in the Crystal City lab under this case number.

A LIMA forensic case management system report containing all examiner process notes, photos, tool details and forms associated with this request is incorporated by reference, and has been provided to the requestor in electronic format with this report. The analysis results reports provided to Carpenter are also included in electronic format with this report.

SENSITIVE BUT UNCLASSIFIED

Page 2

<table><thead><tr><th>Case Number:</th><th>2019-010614</th></tr></thead></table>

EFTA00062275