Correspondence, 2021-05-24

Subject: RE: US v. Maxwell - [conferral re photo and other discovery deficiencies]¶

Date: Mon, 24 May 2021 13:34:01 +0000¶

Inline-Images: image001.png; image002.png¶

Thanks very much, . Would be great if you’re able to join the 11am call.¶

Subject: Re: US v. Maxwell - [conferral re photo and other discovery deficiencies]¶

Just as an FYI, I’ve looked at our files and we do not have for the files listed in the “overlay”, we have no matching MD5s. The MD5s from the non-nude index are correct, but not the overlay ones.¶

I’m around if anyone wants to chat.¶

Subject: [EXTERNAL EMAIL] - FW: US v. Maxwell - [conferral re photo and other discovery deficiencies]¶

Hi all,¶

Please see below from Maxwell’s attorneys regarding the images produced from the CDs seized from Epstein’s residence, which was the PROD011 production from PAE. Can we please have a call to discuss?¶

Thanks,¶

Subject: RE: US v. Maxwell - [conferral re photo and other discovery deficiencies]¶

EFTA00090662¶

Thank you for your explanation. I also have gone back to our IT department and, unfortunately, your FBI/vendor explanation is insufficient.¶

• Based on our review, which has been double-checked, there are hash values in the overlay that don’t match the index and visa-versa.

• The snips below show an example of an entry from the overlay file you provided (with file names and MD5 Hash) which did not join to the non-nude index. We were able to find the corresponding file in the index using the file name, which in this particular instance was unique. As you can see, the MD5 hashes don’t match.

From the overlay file¶

ProdBegBates	File Name	MD5 Hash
SDNY_GM_00503260	Jeffrey VF2.psd	DA92DF87819FCC13F38E0584D8D77DFB
SDNY_GM_00506551	LSJ librarywindow150dpi.tif	58AC5CBE826591AEFD0604ABA226272D

From non-nude index¶

File Name	SHA-1	MD5
LSJ librarywindow150dpi.tif	043670EDF17D35EE5794EBDF094AEF63A95D4B9A	BDEB66247E99D1C9EED2BA30FB8F72D5

• More importantly, if as you report you did not deduplicate the production and if the index you produced is accurate, we should be able to match files based on the combination of File Name and MD5 hash. The hash + file name combination might not be unique, but each hash+file name value in the index should have a corresponding entry in the overlay unless hash values and/or file names were modified somewhere in the process.

• As previously reported, if we require a match on the hash value and ignore file names, there are 65 production numbers that don’t match the index.

• There are more entries in SDNY011 (40,567) than entries on the non-nude index (40,536). We cannot understand the discrepancy based on your explanation.

My earlier requests - a new copy of the non-nude index with an added column to note the production number of each file and a new index for the produced files that were not included in the prior index – still stand.¶

Thank you,¶

Laura¶

Laura A. Menninger | Partner¶

Haddon, Morgan & Foreman, P.C.¶

150 ■. 10th Avenue | Denver, CO 80203¶

Laura,¶

I have consulted with the FBI and our vendor regarding the issues you raised with the overlay. Below is what I understand from them:¶

• When using the overlay, you should require only a match of the hash value.

• When our vendor uses the overlay, they do not see any production numbers that do not have a match in the index. If you are still seeing outliers, please let us know which files are not matching up with the index, and our vendor will look into what that issue could be.

EFTA00090663¶

• The 17 files with no hash values were either incomplete files or corrupt files when they were recovered from the CDs. We produced them to you so that you would have a copy of every file on the CDs that did not have identifiable nudity.

• Any non-unique hash values are duplicate files. There were many duplicate files on the CDs. The FBI and vendor did not deduplicate the images before producing them in an effort to ensure that you had a complete set of all files recovered from the CDs.

• There are a number of files that were recovered from the CDs but are unopenable on our end. We produced them to you so that you would have a copy of every file on the CDs that did not have identifiable nudity. If you would like to check to see if any particular files are unopenable on our end, we would be happy to check.

Given the above, the FBI and the vendor believe the overlay previously provided should be sufficient to allow you to review the metadata in this production.¶

Subject: FW: US v. Maxwell - [conferral re photo and other discovery deficiencies]¶

Thank you for sending the overlay. After review, it unfortunately does not appear sufficient to allow us to properly match the metadata to your production of native files.¶

Based on your representations, the “Non-Nude index” located at Bates 467567 in Excel should match the Bates number native images produced at SDNY011. However:¶

• The number of entries in the Non-Nude Index is less than the number of files produced.

• Although the overlay file has 40,567 entries (the same number of files in SDNY011), they don’t match up to the Non-Nude Index.

  • When joining the overlay file to the index:

• If we require a matching value for both MD5 hash and file name, there are 24,757 entries in the overlay that do not match the index.

• If we require a match on the hash value and ignore file names, there are 65 production numbers that don’t match the index; 17 of those don’t have hash values at all.

• The overlay has many non-unique hash values, meaning we cannot rely on hash value alone.

• The Non-Nude index also has many non-unique hash values.

I think the only feasible resolution is for you to provide a new copy of the non-nude index with an added column to note the production number of each file. We also need a new index for the produced files that were not included in the prior index.¶

Let me know if you will agree to produce these two new indices.¶

Thank you,¶

Laura¶

Laura A. Menninger | Partner¶

Haddon, Morgan & Foreman, P.C.¶