U.S. Department of Justice

Office of the Inspector General

REPORT OF FORENSIC EXAMINATION

<table border="1"><tr><td colspan="2">SUBMITTER</td><td>DATE SUBMITTED</td><td>CASE NUMBER</td></tr><tr><td colspan="2">Special Agent New York Field Office</td><td>August 13, 2019</td><td>2019-010614</td></tr><tr><td>OFFICE CONDUCTING EXAMINATION</td><td>CYBER ID</td><td colspan="2">SUBJECT(S)</td></tr><tr><td>Cyber Investigations Office</td><td>0384</td><td colspan="2">Correctional Officer Michael Thomas, Federal Bureau of Prisons, Metropolitan Correctional Center, New York, NY</td></tr></table>

DIGITAL DEVICE(S) EXAMINED

1. Samsung Galaxy S9 IMEI: 355028093551622 (Device 1 – BOP issued to

2. Samsung Galaxy S9 IMEI: 355028093486118 (Device 2 – BOP issued to



3. Samsung Galaxy S9 IMEI: 355028093495721 (Device 3 – BOP issued to



Synopsis


On August 22, 2019, U.S. Department of Justice, Office of the Inspector General (OIG), Cyber Investigations Office (CYBER) Special Agent (SA) and Assistant Special Agent in Charge received and manually reviewed Devices 1-3 at the Federal Bureau of Prisons (BOP) Metropolitan Correctional Center, located in New York, NY. and were assisted by OIG Washington Field Office SA and OIG Fraud Detection Office SA . Devices 1-3 were BOP issued mobile devices which were provided to CYBER in order to determine whether or not they contained any unauthorized communication related to the suicide of Jeffery Epstein.

OIG New York Field Office SA was investigating alleged BOP employee misconduct related to Epstein’s suicide, and sought the review of Devices 1-3 out of an abundance of caution. There were no allegations of misconduct against the BOP employees to whom Devices 1-3 had been issued. Accordingly, CYBER personnel elected to perform only manual reviews of the phones to limit the disruption of service and to minimize the intrusiveness of the review. In order to fully analyze the BOP devices with forensic tools, CYBER would have had to have manipulated settings on each phone which would have resulted in a loss of data and the need to wipe and reissue each one. The manual review did not limit the data CYBER would have been able to recover using forensic tools for this model phone.

On December 7, 2019, submitted an OIG Digital Forensics Examination Request form seeking a review of Devices 1-3 for the aforementioned data.

The CYBER manual review consisted of a search for communication capable applications on each device, excluding email. Only the native device messaging application on each device was found to meet the criteria of the search. and reviewed all messages within the application that occurred after Epstein’s suicide

SENSITIVE BUT UNCLASSIFIED

<table border="1"><tr><td>EXAMINER NAME AND TITLE:</td><td>SA</td><td>REVIEWER NAME AND TITLE:</td><td>ASAC</td></tr><tr><td>SIGNATURE:
Kevin John
Digitally signed by
DN: c=US, o=U.S. Government, ou=Dept of Justice, ou=OIG, cn=
0.9.2342.19200300.100.1.1=15001001073402
Date: 2020.02.20 21:37:41 -05&#x27;00&#x27;</td><td>SIGNATURE:</td><td>Digitally signed by
DN: c=US, o=U.S. Government,
ou=Dept of Justice, ou=OIG,
cn=
0.9.2342.19200300.100.1.1=15001002
300273
Date: 2020.02.21 07:42:44 -05&#x27;00&#x27;</td></tr></table>





OIG Form III-235/2 (02/10/17) This document contains neither recommendations nor conclusions of the IG. It is the property of the IG and is loaned to your agency; it and its contents are not to be distributed outside of your agency.



EFTA00087827


on the morning of August 10, 2019. The search did not reveal any messages that appeared to contain inappropriate or unauthorized communication related to Epstein’s death. Only one message, located on Device 1, was found to relate to the topic of Epstein. The message appeared to be an appropriate exchange that served to reiterate the staff's instructions not to comment on the ongoing matter. A copy of the message can be viewed by clicking this link.

All documentation related to this forensic request will be retained by CYBER on the Archive Network Attached Storage located in the New York City lab under this case number.

A LIMA forensic case management system report containing all examiner process notes, photos, tool details and forms associated with this request is incorporated by reference, and has been provided to the requestor in electronic format with this report. The analysis result file provided to is also included in electronic format with this report.

# SENSITIVE BUT UNCLASSIFIED

Page 2

<table><thead><tr><th>Case Number:</th><th>2019-010614</th></tr></thead></table>



EFTA00087828