90A-NY-3151227 Serial 115 FD-1036 (Rev. 10-16-2009) # UNCLASSIFIED FEDERAL BUREAU OF INVESTIGATION Import Form Form Type: DEL REX - Digital Evidence Laboratory Report of Examination Date: 09/10/2019 Title: (U) 90A-NY-3151227 Process Report Approved By: Drafted By: Case ID #: 90A-NY-3151227 (U) UNSUB(S); JEFFREY EPSTEIN - VICTIM; DEATH INVESTIGATION Synopsis: (U) To upload CART Process Report for cloning and imaging processes conducted on Evidence Items 1B1 to 1B18. UNCLASSIFIED EFTA00130643 18-21 (Rev. 08-15-2017) # Federal Bureau of Investigation Computer Analysis Response Team 26 Federal Plaza New York, NY 10278 ## PROCESS REPORT **To:** New York Date: September 9, 2019 Case ID: 90A-NY-3151227 Request Date: 08/12/2019 Request No.: 112048 ## Submitted Evidence Items: 1B1/NYC023578 One (1) Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CJJA, from MCC Nice Vision DVR2 Surveillance System (1 of 18). 1B2/NYC023579 One (1) Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36A13K from MCC Nice Vision DVR2 Surveillance System (2 of 18). 1B3/NYC023580 One (1) One (1) Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CF5X, from MCC Nice Vision DVR2 Surveillance System (3 of 18). 1B4/NYC023581 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MT9P, from MCC Nice Vision DVR2 Surveillance System (4 of 18). 1B5/NYC023582 One (1) Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36MWNK, from MCC Nice Vision DVR2 Surveillance System (5 of 18). 1B6/NYC023583 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8EC75, from MCC Nice Vision DVR2 Surveillance System (6 of 18). 1B7/NYC023584 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZPE, from MCC Nice Vision DVR2 Surveillance System (7 of 18). 1B8/NYC023585 One (1) Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9Z911026, from MCC Nice Vision DVR2 Surveillance System (8 of 18). 1B9/NYC023586 One (1) Western Digital 500GB HDD, WD5000AAKX- 60U6AA0, S/N WCC2EJUC34CJ, from MCC Nice Vision DVR2 Surveillance System (9 of 18). 1B10/NYC023587 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSEZ, from MCC Nice Vision DVR2 Surveillance System (10 of 18). 1B11/NYC023588 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PX26, from MCC Nice Vision DVR2 Surveillance System (11 of 18). 1B12/NYC023589 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1Q1FX, from MCC Nice Vision DVR2 Surveillance System (12 of 18). EFTA00130644 1B13/NYC023590 One (1) Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9T870016, from MCC Nice Vision DVR2 Surveillance System (13 of 18). 1B14/NYC023591 One (1) Western Digital 500GB HDD, WD5000AAKX-60U6AA0, S/N WCC2E0DE83YK, from MCC Nice Vision DVR2 Surveillance System (14 of 18). 1B15/NYC023592 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MT6D, from MCC Nice Vision DVR2 Surveillance System (15 of 18). 1B16/NYC023593 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZ07, from MCC Nice Vision DVR2 Surveillance System (16 of 18). 1B17/NYC023594 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1L0YG, from MCC Nice Vision DVR2 Surveillance System (17 of 18). 1B18/NYC023595 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSRR, from MCC Nice Vision DVR2 Surveillance System (18 of 18). ## Details: On August 12, 2019, FBI Special Agent (SA) requested Computer Analysis Response Team (CART) support with inventorying and processing hard drives acquired from a Nice Vision DVR2 Sureillance System located at the Metropolitan Correctional Center (MCC) in New York City, NY. SA/Forensic Examiner (FE) received custody of the hard drives and advised that the drives would be logged into Evidence, cloned and imaged. Between August 12the and August 15th, 2019, the referenced work was performed on the evidence hard drives, with details of the work outlined herein. The physical evidence hard drives were returned to SA on August 15, 2019. In addition, both the clones and images collected were entered into Evidence Control (see description below under Derivative Evidence). CLONING The following cloning processes were performed on August 12, 2019: DRIVE 1B1 - NYC023578 Device: Tableau TX-1, S/N 000ECC58017139, F2882257 Source: Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CJJA Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N S1D85PLA DRIVE 1B2 - NYC023579 Device: Tableau TX-1, S/N 000ECC5801109B Source: Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36A13K Destination: Hitachi 1TB HDD, HUA722010CLA330, S/N JPW9K0N039EZLL 90A-NY-3151227 Request 112048 Page 2 of 8 EFTA00130645 DRIVE 1B3 - NYC023580 Device: Tableau TX-1, S/N 000ECC58017156 Source: Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CF5X Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N Z1D3ZSS0 DRIVE 1B4 - NYC023581 Device: Tableau TX-1, S/N 000ECC58017194 Source: Seagate Barracuda 500GB, ST3500320NS, S/N 9QM8MT9P Destination: Seagate Desktop 1TB HDD, ST1000DM003, S/N Z4YDJL1T DRIVE 1B5 - NYC023582 Device: Tableau TD3–B, S/N 01D3B07E-1331 Source: Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36MWNK Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N Z1DB81XJ *Result: TD3 could not see drive #5 and the source drive was clicking, attempting LBCD. Attempted FBI-CART Linux Boot CD: Version 6.1 April 2018 1 GB RAM using forensic work station Dell Precision Model P13F, F1499048, Service Tag HN3SZQ1 Write Blocker used: Tableau eSata Forensic Bridge, model T35es-R2, S/N: 2135E196-1235 *Result: FBI-CART Linux boot CD cannot read the drive. DRIVE 1B5 APPEARS TO BE DEAD. DRIVE 1B6 - NYC023583 Device: Tableau TD3–B, S/N 01D3B07E-1331 Source: Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8EC75 Destination: Seagate Desktop HDD 1TB, ST1000DM003, S/N Z4YDHX5M DRIVE 1B7 - NYC023584 Device: Tableau TD3–B, S/N 11D350F0-1525 Source: Seagate Constellation ES 500GB, ST500NM0011, S/N Z1M1PZPE Destination: Seagate Barracuda 1000GB, ST1000DM003, S/N W1D48YH6 DRIVE 1B8 - NYC023585 Device: Tableau TD3–B, S/N 01D3407C-1222 Source: Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9Z911026 Destination: Western Digital 1TB HDD, WD10EADS- 00L5B1, S/N WCAU45803950 DRIVE 1B9 - NYC023586 Device: Tableau TD3-B, S/N 01D3B08D-1331 Source: Western Digital 500GB HDD, WD5000AAKX-60U6AA0, S/N WCC2EJUC34CJ 90A-NY-3151227 Request 112048 Page 3 of 8 EFTA00130646 Destination: Seagate Desktop HDD 1000GB HDD, ST100DM003, S/N Z4Y00Q48 DRIVE 1B10 - NYC023587 Device: Tableau TD3-B, S/N 11D350F6-1525 Source: Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSEZ Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N W1D496N0 DRIVE 1B11 - NYC023588 Device: Tableau TD3-B, S/N 01D3B09E-1331 Source: Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PX26 Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N Z1DB25CT DRIVE 1B12 - NYC023589 Device: Tableau TX-1, S/N 000ECC58017139, F2882257 Source: Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1Q1FX. Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N W1D38Z6E. DRIVE 1B13 – NYC023590 Device: Tableau TX-1, S/N 000ECC5801109B Source: Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9T870016 *Result: TX-1 was reading/writing very slow; cloning job terminated. Destination: Western Digital 1000GB HDD, WD10EACS-00ZJB0, S/N WCASJ1491791 will use attempt LBCD command line to clone: Source: Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9T870016 Destination: Western Digital 1TB HDD, S/N WCC3F2783371. *Resut: LBCD did not work. DRIVE 1B13 APPEARS TO BE DEAD. ## DRIVE 1B14 (The swap Drive/Original was swapped out for this one)- NYC023591 Device: Source: Western Digital 500GB HDD, WD5000AAKX-60U6AA0, S/N WCC2E0DE83YK. Destination: *Attempted to use both a TX-1 and TD3-B device, but neither device could read the 1B14 drive. Attempted to use FBI-CART Linux Boot CD: Version 6.1 April 2018 1 GB RAM using forensic work station Dell Precision Model P13F, Service Tag HN3SZQ1, F1499048. Write Blocker used: Tableau eSata Forensic Bridge, model T35es-R2, S/N: 2135E196 1235 90A-NY-3151227 Request 112048 Page 4 of 8 EFTA00130647 *Result: FBI-CART Linux boot CD cannot read the drive. DRIVE 1B14 APPEARS TO BE DEAD. DRIVE 1B15 - NYC023592 Device: Tableau TX-1, S/N 000ECC58017156 Source: Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MT6D Destination: Western Digital 1000GB HDD, WD1003FZEX-00MK2A0. DRIVE 1B16 - NYC023593 Device: Tableau TX-1, S/N 000ECC58017194 Source: Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZ07 Destination: Seagate Barracuda 1000 GB, ST1000DM003, S/N S1D9GK9P DRIVE 1B17 (THIS IS THE ORIGINAL 1B9) – NYC023594 Device: Tableau TD-3 –B, S/N 11D350F0-1525 Source: Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1L0YG Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N S1D9DETC *Errors indicated during cloning (see log) DRIVE 1B18 (THIS IS THE ORIGINAL 1B14) – NYC023595 Device: Tableau TD-3 –B, S/N 01D3B07E-1331 Source: Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSRR Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N 9YN162-300 *Errors indicated during cloning (see log) ## IMAGING Imaging processes were performed on each evidence hard drive (not including 1B5, 1B13, and 1B14), from August 13, 2019 to August 15, 2019. Images were placed onto two (2) destination hard drives, entered into Evidence as 1B43/NYC023596 and 1B42/NYC023597. All E01 images collected were verified, with the following images located on each hard drive: 1. HDD Destination 1/1B43/NYC023596: Contains verified E01 images of 1B1, 2, 3, 4, 6, 7, 8, 9, 10, 11, and 15. 2. HDD Destination 2/1B42/NYC023597: Contains verified E01 images of 1B12, 16, 17, and 18. ## DERIVATIVE EVIDENCE GENERATED The following CART Derivative Evidence was generated and entered into Evidence Control: 90A-NY-3151227 Request 112048 Page 5 of 8 EFTA00130648 1B22/NYC027701: One (1) Seagate Barracuda 1000GB Hard Drive, model ST1000DM003, S/N S1D85PLA, containing the Clone Copy of 1B1 hard drive (Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CJJA), collected via Tableau TX-1, S/N 000ECC58017139 (F2882257). Request ID 112048. Derivative Copy. 1B23/NYC027702: One (1) Hitachi 1TB Hard Drive, HUA722010CLA330, S/N JPW9K0N039EZLL, containing the Clone Copy of 1B2 hard drive (Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36A13K), collected via Tableau TX-1, S/N 000ECC5801109B. Request ID 112048. Derivative Copy. 1B24/NYC027703: One (1) Seagate Barracuda 1000GB Hard Drive, model ST1000DM003, S/N Z1D3ZSS0, containing the Clone Copy of 1B3 hard drive (Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CF5X), collected via TX-1, S/N 000ECC58017156. Request ID 112048. Derivative Copy. 1B25/NYC027704: One (1) Seagate Desktop 1TB hard drive, model ST1000DM003, S/N Z4YDJL1T, containing the Clone Copy of 1B4 hard drive (Seagate Barracuda 500GB Hard Drive, ST3500320NS, S/N 9QM8MT9P), collected via Tableau TX-1 S/N 000ECC58017194. Request ID 112048. Derivative Copy. 1B26/NYC027705: One (1) Seagate Desktop 1TB hard drive, model ST1000DM003, S/N Z4YDHX5M, containing the Clone Copy of 1B6 hard drive (Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8EC75), collected via Tableau TD-3 –B S/N 01D3B07E-1331. Request ID 112048. Derivative Copy. 1B27/NYC027706: One (1) Seagate Barracuda 1000GB Hard Drive, model ST1000DM003, S/N W1D48YH6, containing the Clone Copy of 1B7 hard drive (Seagate Constellation ES 500GB, ST500NM0011, S/N Z1M1PZPE), collected via Tableau TD3-B, S/N 11D350F0-1525. Request ID 112048. Derivative Copy. 1B28/NYC027707: One (1) Western Digital 1TB hard drive, WD10EADS-00L5B1, S/N WCAU45803950, containing the Clone Copy of 1B8 hard drive (Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9Z911026), collected via Tableau TD3-B, S/N 01D3407C-1222. Request ID 112048. Derivative Copy. 1B29/NYC027708: One (1) Seagate Desktop 1000GB HDD, ST100DM003, S/N Z4Y00Q48, containing the Clone Copy of 1B9 hard drive (Western Digital 500GB HDD, WD5000AAKX-60U6AA0, S/N WCC2EJUC34CJ), collected via Tableau TD3-B S/N 01D3B08D-1331. Request ID 112048. Derivative Copy. 90A-NY-3151227 Request 112048 Page 6 of 8 EFTA00130649 1B30/NYC027709: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N W1D496N0, containing the Clone Copy of 1B10 hard drive (Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSEZ), collected via Tableau TD3-B S/N 11D350F6-1525. Request ID 112048. Derivative Copy. 1B31/NYC027710: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N Z1DB25CT, containing the Clone Copy of 1B11 hard drive (Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PX26), collected via Tableau TD3-B S/N 01D3B09E-1331. Request ID 112048. Derivative Copy. 1B32/NYC027711: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N W1D48Z6E, containing the Clone Copy of 1B12 hard drive (Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1Q1FX), collected via Tableau TX-1, S/N 000ECC58017139. Request ID 112048. Derivative Copy. 1B33/NYC027712: One (1) Western Digital 1000GB HDD, WD1003FZEX-00MK2A0, S/N WCC3F2783519, containing the Clone Copy of 1B15 hard drive (Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MT6D), collected via Tableau TX-1, S/N 000ECC58017156. Request ID 112048. Derivative Copy. 1B34/NYC027713: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N S1D9GK9P, containing the Clone Copy of 1B16 hard drive (Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZ07), collected via Tableau TX-1 S/N 000ECC58017194. Request ID 112048. Derivative Copy. 1B35/NYC027714: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N S1D9DETC, containing the Clone Copy of 1B17 hard drive (Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1L0YG), collected via Tableau TD3-B, S/N 11D350F0-1525. Request ID 112048. Derivative Copy. 1B36/NYC027715: One (1) Seagate Barracuda, 1000GB HDD, ST1000DM003, S/N W1D06T5L, containing the Clone Copy of 1B18 hard drive (Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSRR), collected via Tableau TD3–B, S/N 01D3B07E-1331. Derivative Copy. 1B42/NYC023597: One (1) Hitachi 2TB Hard Drive, 0F10311JPK3EA0P09, S/N B9GMGTYF, containing the verified E01 images NYC023589 (1B12), NYC023593 (1B16), NYC023594 (1B17), and NYC023595 (1B18). Master Copy. 1B43/NYC023596: One (1) WD Black 3TB hard drive, WD3003FZEX-00Z4SA0, S/N WCC13LZR579P, containing the verified E01 images NYC023578 (1B1), NYC023579 (1B2), 90A-NY-3151227 Request 112048 Page 7 of 8 EFTA00130650 NYC023580 (1B3), NYC023581 (1B4), NYC023583 (1B6), NYC023584 (1B7), NYC023585 (1B8), NYC023586 (1B9), NYC023587 (1B10), NYC023588 (1B11), and NYC023592 (1B15). Master Copy. No further substantive work performed. All evidence items were either returned to the custody of the case agent or Evidence Control. No electronic media is being retained by the New York Division CART Unit. Digitally Signed Examiner: SA/FE Computer Analysis Response Team – New York 90A-NY-3151227 Request 112048 Page 8 of 8