EFTA00128371 Tableau device serial number: 11d2003b
Tableau device serial number: 11d2003b
Tableau firmware revision: 4.01
Tableau firmware timestamp: May 02 2013 21:35:47
Source device model: ST500DM002-1BD142
Source device serial number: Z6E8M349
Source device HPA in use: No
Source device DCO in use: No
Source device capacity reported Pwr-ON: 976,773,168(500.1GB)
Source device capacity reported by HPA: 976,773,168(500.1GB)
Source device capacity reported by DCO: 976,773,168(500.1GB)
Attachment(s) 2019-08-11 16-43-11 00107 D2F.LOG | Evidence Reference | 0003 | | :--- | :--- | | Evidence Type | Desktop | | :--- | :--- | | Logged In Date/Time | 08/13/2019 09:00:35 (-0400) | | :--- | :--- | Original Seal Number N/A | Storage Location | Washington Vault | | :--- | :--- | High Description HP EliteDesk 800 S/N: 2UA4381YMW | Property Number | 0214 207270 | | :--- | :--- | | Seized Date/Time | 08/11/2019 11:00:03 (-0400) | | :--- | :--- | Seized By/Produced By | Processing Result | N/A | | :--- | :--- | | Archived | No | | :--- | :--- | Pre-Imaging Details | Start Date/Time | 08/14/2019 19:00:00 (-0400) | | :--- | :--- | | End Date/Time | 08/14/2019 19:25:00 (-0400) | | :--- | :--- | Conducted By (Name) Manufacturer Hewlett Packard EliteDesk 800 | Serial Number | 2UA4381YMW | | :--- | :--- |
Casing ColourBlack
| BIOS Key | F10 | | :--- | :--- | BIOS Date/Time 08/14/2019 19:18 | Actual Date/Time | 08/14/2019 19:18 | | :--- | :--- |
Password ProtectedNo
Attachment(s) IMG_0073.JPG | Evidence Reference | 0004 | | :--- | :--- | | Evidence Type | Hard Drive | | :--- | :--- | | Logged In Date/Time | 08/13/2019 09:00:35 (-0400) | | :--- | :--- | Original Seal Number N/A | Storage Location | Washington Vault | | :--- | :--- | | Priority | High | | :--- | :--- | | Description | Seagate 500 GB SATA HDD S/N: Z6E8K1EV | | :--- | :--- | EFTA00128372
Property NumberN/A
| Processing Result | N/A | | :--- | :--- | | Archived | No | | :--- | :--- | Pre-Imaging Details | Start Date/Time | 08/11/2019 16:00:00(-0400) | | :--- | :--- | Conducted By (Name) Manufacturer Seagate | Model | ST500DM002 | | :--- | :--- | | Serial Number | Z6E8K1EV | | :--- | :--- | | Type | SATA HDD | | :--- | :--- | Notes Drive removed from desktop 0214 207270 for imaging by Lidsky on 8/11/19 at CC lab. Attachment(s) Imaging Details | Start Date/Time | 08/11/2019 18:17:11 (-0400) | | :--- | :--- | | End Date/Time | 08/11/2019 21:16:00 (-0400) | | :--- | :--- |
Software UsedTableau
| Write Blocker | Tableau TD2 (X29946) | | :--- | :--- | | Image Type | E01 | | :--- | :--- | | Compression | None | | :--- | :--- | Block Size 64 Cyclic Redundancy Check (CRC) 64 MD5 48f956e5ddab702d48177534ec96d026
SHA1be9791bce5978ccdf3111a54eac84606739c0424
| Image Verified | No | | :--- | :--- | Imaging Workstation N/A
NotesImaging started:2019-08-11 18:17
Imaging finished:2019-08-11 21:16
Tableau device serial number:11d2003b
Tableau firmware revision:4.01
Tableau firmware timestamp:May 02 2013 21:35:47
Source device model:ST500DM002-1BD142
Source device serial number:Z6E8K1EV
Source device HPA in use:No
Source device DCO in use:No
Attachment(s)Source device capacity reported Pwr-ON:976,773,168(500.1GB)
Source device capacity reported by HPA:976,773,168(500.1GB)
Source device capacity reported by DCO:976,773,168(500.1GB)
Case Photographs 0001; IMG 0046.JPG 3893_IMG_0046.JPG EFTA00128373
IDImage Name
0001IMG_0047.JPG
3894IMG_0047.JPG
0001IMG_0048.JPG
3895IMG_0048.JPG
0001IMG_0049.JPG
3896IMG_0049.JPG
0001IMG_0050.JPG
3897IMG_0050.JPG
0001IMG_0051.JPG
3898IMG_0051.JPG
0001IMG_0052.JPG
3899IMG_0052.JPG
0001IMG_0053.JPG
3900IMG_0053.JPG
0001IMG_0054.JPG
3901IMG_0054.JPG
0001IMG_0055.JPG
3902IMG_0055.JPG
0001IMG_0056.JPG
3903IMG_0056.JPG
0001IMG_0057.JPG
3916IMG_0057.JPG
0002IMG_0058.JPG
3904IMG_0058.JPG
0002IMG_0059.JPG
3905IMG_0059.JPG
0002IMG_0057.JPG
3920IMG_0057.JPG
0003IMG_0060.JPG
3906IMG_0060.JPG
0003IMG_0061.JPG
3907IMG_0061.JPG
0003IMG_0062.JPG
3908IMG_0062.JPG
0003IMG_0063.JPG
3909IMG_0063.JPG
0003IMG_0064.JPG
3910IMG_0064.JPG
0003IMG_0065.JPG
3911IMG_0065.JPG
0003IMG_0066.JPG
3912IMG_0066.JPG
0003IMG_0067.JPG
3913IMG_0067.JPG
0003IMG_0068.JPG
3914IMG_0068.JPG
0003IMG_0069.JPG
3915IMG_0069.JPG
0004IMG_0069.JPG
3917IMG_0069.JPG
0004IMG_0070.JPG
3918IMG_0070.JPG
0004IMG_0071.JPG
3919IMG_0071.JPG
EFTA00128374 Case Disposal EFTA00128375
Line NumberDateFile Name
1213, 16:8/10/2019
0:39:31 User saves/downloads document named "SHU 30 CHECK SHEET (CONDENSED)_1.docx" to location "C:\Users\bop19012\Documents\GroupWise"
1213, 16:8/10/2019
0:39:31 The "SHU 30 CHECK SHEET (CONDENSED)_1.docx" Word Document is also opened at this time.
1213, 16:8/10/2019
0:43:00 Last Printed timestamp indicates "SHU 30 CHECK SHEET (CONDENSED)_1.docx" was printed
---LOCATED IN ZIP FILE----
1718:8/10/2019
0:44:19 User saves/downloads document named "SHU Rules Metropolitan Correctional Center New York.docx" to location "C:\Users\bop19012\Desktop"
1718:8/10/2019
0:44:19 The "SHU Rules Metropolitan Correctional Center New York.docx" Word Document is also opened at this time
---LOCATED IN ZIP FILE----
19:19:8/10/2019
0:44:53 User opens document named "SHU ORDERLY REQUEST 42214.rtf" from location "C:\Users\bop19012\Desktop"
---LOCATED IN ZIP FILE----
2124:8/10/2019
0:48:20 User opens document named "1 - SHU LOCATOR 2019(HARDCOPY).docx" from network location "\\NYMC_GRPS_SERVER\GRPS\GROUPS\SHAREDC\SHU PAPERWORK, LOCATOR, HARDCOPY"
---NEED TO GET FROM BOP----
31:31:8/10/2019
0:54:06 User opens document named "Daily Fire & Security Form[1].pdf" in Internet Explorer from "http://sallyyport.bop.gov/inst/nym/corrsvc/docs/"
---LOCATED IN ZIP FILE----
34:34:8/10/2019
0:57:18 User open Microsoft Database named "Roster.accde" at "\NYMC_APPS_SERVER\APP\SBOPAPPS\Roster\Ver3.1"
---NEED TO GET FROM BOP----
Documents Associated with Timeline Analysis of Desktop Property # 0214 207270 HDD Image 26EKXIEV.E01 -- Towa Noel (BOP61232)
20:20:8/9/2019
23:46:16 User navigates in IE to "http://www.benefits.va.gov/warms/docs/admin21/mi_1/mr/part3/subptii/ch07/m21-1lii_ii_7.doc"
---LOCATED IN ZIP FILE----
62:62:8/9/2019
5:18:18 User open Microsoft Database named "Roster.accde" at "file://K:/BOPAPPS/Roster/Ver3.1/Roster.accde"
---NEED TO GET FROM BOP----
85:85:5:58:47 User opens file from IE named "nysd-1_2015-cr-00536-446092-00792[1].pdf" -- SENTENCING MEMORANDUM OF OMAR AMANAT
---LOCATED IN ZIP FILE----
EFTA00128376