EFTA00128371¶
Tableau device serial number: 11d2003b¶
| Tableau device serial number: 11d2003b |
| Tableau firmware revision: 4.01 |
| Tableau firmware timestamp: May 02 2013 21:35:47 |
| Source device model: ST500DM002-1BD142 |
| Source device serial number: Z6E8M349 |
| Source device HPA in use: No |
| Source device DCO in use: No |
| Source device capacity reported Pwr-ON: 976,773,168(500.1GB) |
| Source device capacity reported by HPA: 976,773,168(500.1GB) |
| Source device capacity reported by DCO: 976,773,168(500.1GB) |
Attachment(s)¶
2019-08-11 16-43-11 00107 D2F.LOG¶
| Evidence Reference | 0003 |¶
| :--- | :--- |¶
| Evidence Type | Desktop |¶
| :--- | :--- |¶
| Logged In Date/Time | 08/13/2019 09:00:35 (-0400) |¶
| :--- | :--- |¶
Original Seal Number N/A¶
| Storage Location | Washington Vault |¶
| :--- | :--- |¶
High¶
Description HP EliteDesk 800 S/N: 2UA4381YMW¶
| Property Number | 0214 207270 |¶
| :--- | :--- |¶
| Seized Date/Time | 08/11/2019 11:00:03 (-0400) |¶
| :--- | :--- |¶
Seized By/Produced By¶
| Processing Result | N/A |¶
| :--- | :--- |¶
| Archived | No |¶
| :--- | :--- |¶
Pre-Imaging Details¶
| Start Date/Time | 08/14/2019 19:00:00 (-0400) |¶
| :--- | :--- |¶
| End Date/Time | 08/14/2019 19:25:00 (-0400) |¶
| :--- | :--- |¶
Conducted By (Name)¶
Manufacturer Hewlett Packard¶
EliteDesk 800¶
| Serial Number | 2UA4381YMW |¶
| :--- | :--- |¶
| Casing Colour | Black |
| BIOS Key | F10 |¶
| :--- | :--- |¶
BIOS Date/Time 08/14/2019 19:18¶
| Actual Date/Time | 08/14/2019 19:18 |¶
| :--- | :--- |¶
| Password Protected | No |
Attachment(s)¶
IMG_0073.JPG¶
| Evidence Reference | 0004 |¶
| :--- | :--- |¶
| Evidence Type | Hard Drive |¶
| :--- | :--- |¶
| Logged In Date/Time | 08/13/2019 09:00:35 (-0400) |¶
| :--- | :--- |¶
Original Seal Number N/A¶
| Storage Location | Washington Vault |¶
| :--- | :--- |¶
| Priority | High |¶
| :--- | :--- |¶
| Description | Seagate 500 GB SATA HDD S/N: Z6E8K1EV |¶
| :--- | :--- |¶
EFTA00128372¶
| Property Number | N/A |
|---|
| Processing Result | N/A |¶
| :--- | :--- |¶
| Archived | No |¶
| :--- | :--- |¶
Pre-Imaging Details¶
| Start Date/Time | 08/11/2019 16:00:00(-0400) |¶
| :--- | :--- |¶
Conducted By (Name)¶
Manufacturer Seagate¶
| Model | ST500DM002 |¶
| :--- | :--- |¶
| Serial Number | Z6E8K1EV |¶
| :--- | :--- |¶
| Type | SATA HDD |¶
| :--- | :--- |¶
Notes Drive removed from desktop 0214 207270 for imaging by Lidsky on 8/11/19 at CC lab.¶
Attachment(s)¶
Imaging Details¶
| Start Date/Time | 08/11/2019 18:17:11 (-0400) |¶
| :--- | :--- |¶
| End Date/Time | 08/11/2019 21:16:00 (-0400) |¶
| :--- | :--- |¶
| Software Used | Tableau |
|---|
| Write Blocker | Tableau TD2 (X29946) |¶
| :--- | :--- |¶
| Image Type | E01 |¶
| :--- | :--- |¶
| Compression | None |¶
| :--- | :--- |¶
Block Size 64¶
Cyclic Redundancy Check (CRC) 64¶
MD5 48f956e5ddab702d48177534ec96d026¶
| SHA1 | be9791bce5978ccdf3111a54eac84606739c0424 |
| Image Verified | No |¶
| :--- | :--- |¶
Imaging Workstation N/A¶
| Notes | Imaging started:2019-08-11 18:17 |
| Imaging finished:2019-08-11 21:16 | |
| Tableau device serial number:11d2003b | |
| Tableau firmware revision:4.01 | |
| Tableau firmware timestamp:May 02 2013 21:35:47 | |
| Source device model:ST500DM002-1BD142 | |
| Source device serial number:Z6E8K1EV | |
| Source device HPA in use:No | |
| Source device DCO in use:No | |
| Attachment(s) | Source device capacity reported Pwr-ON:976,773,168(500.1GB) |
| Source device capacity reported by HPA:976,773,168(500.1GB) | |
| Source device capacity reported by DCO:976,773,168(500.1GB) |
Case Photographs¶
0001; IMG 0046.JPG¶
3893_IMG_0046.JPG¶
EFTA00128373¶
| ID | Image Name |
|---|---|
| 0001 | IMG_0047.JPG |
| 3894 | IMG_0047.JPG |
| 0001 | IMG_0048.JPG |
| 3895 | IMG_0048.JPG |
| 0001 | IMG_0049.JPG |
| 3896 | IMG_0049.JPG |
| 0001 | IMG_0050.JPG |
| 3897 | IMG_0050.JPG |
| 0001 | IMG_0051.JPG |
| 3898 | IMG_0051.JPG |
| 0001 | IMG_0052.JPG |
| 3899 | IMG_0052.JPG |
| 0001 | IMG_0053.JPG |
| 3900 | IMG_0053.JPG |
| 0001 | IMG_0054.JPG |
| 3901 | IMG_0054.JPG |
| 0001 | IMG_0055.JPG |
| 3902 | IMG_0055.JPG |
| 0001 | IMG_0056.JPG |
| 3903 | IMG_0056.JPG |
| 0001 | IMG_0057.JPG |
| 3916 | IMG_0057.JPG |
| 0002 | IMG_0058.JPG |
| 3904 | IMG_0058.JPG |
| 0002 | IMG_0059.JPG |
| 3905 | IMG_0059.JPG |
| 0002 | IMG_0057.JPG |
| 3920 | IMG_0057.JPG |
| 0003 | IMG_0060.JPG |
| 3906 | IMG_0060.JPG |
| 0003 | IMG_0061.JPG |
| 3907 | IMG_0061.JPG |
| 0003 | IMG_0062.JPG |
| 3908 | IMG_0062.JPG |
| 0003 | IMG_0063.JPG |
| 3909 | IMG_0063.JPG |
| 0003 | IMG_0064.JPG |
| 3910 | IMG_0064.JPG |
| 0003 | IMG_0065.JPG |
| 3911 | IMG_0065.JPG |
| 0003 | IMG_0066.JPG |
| 3912 | IMG_0066.JPG |
| 0003 | IMG_0067.JPG |
| 3913 | IMG_0067.JPG |
| 0003 | IMG_0068.JPG |
| 3914 | IMG_0068.JPG |
| 0003 | IMG_0069.JPG |
| 3915 | IMG_0069.JPG |
| 0004 | IMG_0069.JPG |
| 3917 | IMG_0069.JPG |
| 0004 | IMG_0070.JPG |
| 3918 | IMG_0070.JPG |
| 0004 | IMG_0071.JPG |
| 3919 | IMG_0071.JPG |
EFTA00128374¶
Case Disposal¶
EFTA00128375¶
| Line Number | Date | File Name |
|---|---|---|
| 12 | 13, 16: | 8/10/2019 0:39:31 User saves/downloads document named "SHU 30 CHECK SHEET (CONDENSED)_1.docx" to location "C:\Users\bop19012\Documents\GroupWise" |
| 12 | 13, 16: | 8/10/2019 0:39:31 The "SHU 30 CHECK SHEET (CONDENSED)_1.docx" Word Document is also opened at this time. |
| 12 | 13, 16: | 8/10/2019 0:43:00 Last Printed timestamp indicates "SHU 30 CHECK SHEET (CONDENSED)_1.docx" was printed |
| ---LOCATED IN ZIP FILE---- | ||
| 17 | 18: | 8/10/2019 0:44:19 User saves/downloads document named "SHU Rules Metropolitan Correctional Center New York.docx" to location "C:\Users\bop19012\Desktop" |
| 17 | 18: | 8/10/2019 0:44:19 The "SHU Rules Metropolitan Correctional Center New York.docx" Word Document is also opened at this time |
| ---LOCATED IN ZIP FILE---- | ||
| 19: | 19: | 8/10/2019 0:44:53 User opens document named "SHU ORDERLY REQUEST 42214.rtf" from location "C:\Users\bop19012\Desktop" |
| ---LOCATED IN ZIP FILE---- | ||
| 21 | 24: | 8/10/2019 0:48:20 User opens document named "1 - SHU LOCATOR 2019(HARDCOPY).docx" from network location "\\NYMC_GRPS_SERVER\GRPS\GROUPS\SHAREDC\SHU PAPERWORK, LOCATOR, HARDCOPY" |
| ---NEED TO GET FROM BOP---- | ||
| 31: | 31: | 8/10/2019 0:54:06 User opens document named "Daily Fire & Security Form[1].pdf" in Internet Explorer from "http://sallyyport.bop.gov/inst/nym/corrsvc/docs/" |
| ---LOCATED IN ZIP FILE---- | ||
| 34: | 34: | 8/10/2019 0:57:18 User open Microsoft Database named "Roster.accde" at "\NYMC_APPS_SERVER\APP\SBOPAPPS\Roster\Ver3.1" |
| ---NEED TO GET FROM BOP---- | ||
| Documents Associated with Timeline Analysis of Desktop Property # 0214 207270 HDD Image 26EKXIEV.E01 -- Towa Noel (BOP61232) | ||
| 20: | 20: | 8/9/2019 23:46:16 User navigates in IE to "http://www.benefits.va.gov/warms/docs/admin21/mi_1/mr/part3/subptii/ch07/m21-1lii_ii_7.doc" |
| ---LOCATED IN ZIP FILE---- | ||
| 62: | 62: | 8/9/2019 5:18:18 User open Microsoft Database named "Roster.accde" at "file://K:/BOPAPPS/Roster/Ver3.1/Roster.accde" |
| ---NEED TO GET FROM BOP---- | ||
| 85: | 85: | 5:58:47 User opens file from IE named "nysd-1_2015-cr-00536-446092-00792[1].pdf" -- SENTENCING MEMORANDUM OF OMAR AMANAT |
| ---LOCATED IN ZIP FILE---- | ||
EFTA00128376¶