90A-NY-3151227 Serial 115¶
FD-1036 (Rev. 10-16-2009)¶
UNCLASSIFIED¶
FEDERAL BUREAU OF INVESTIGATION¶
Import Form¶
Form Type: DEL REX - Digital Evidence Laboratory Report of Examination¶
Date: 09/10/2019¶
Title: (U) 90A-NY-3151227 Process Report¶
Approved By:¶
Drafted By:¶
Case ID #: 90A-NY-3151227¶
(U) UNSUB(S);¶
JEFFREY EPSTEIN - VICTIM;¶
DEATH INVESTIGATION¶
Synopsis: (U) To upload CART Process Report for cloning and imaging processes conducted on Evidence Items 1B1 to 1B18.¶
UNCLASSIFIED¶
EFTA00130643¶
18-21 (Rev. 08-15-2017)¶
Federal Bureau of Investigation Computer Analysis Response Team¶
26 Federal Plaza New York, NY 10278¶
PROCESS REPORT¶
To: New York¶
Date: September 9, 2019¶
Case ID: 90A-NY-3151227¶
Request Date: 08/12/2019¶
Request No.: 112048¶
Submitted Evidence Items:¶
1B1/NYC023578 One (1) Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CJJA, from MCC Nice Vision DVR2 Surveillance System (1 of 18).¶
1B2/NYC023579 One (1) Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36A13K from MCC Nice Vision DVR2 Surveillance System (2 of 18).¶
1B3/NYC023580 One (1) One (1) Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CF5X, from MCC Nice Vision DVR2 Surveillance System (3 of 18).¶
1B4/NYC023581 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MT9P, from MCC Nice Vision DVR2 Surveillance System (4 of 18).¶
1B5/NYC023582 One (1) Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36MWNK, from MCC Nice Vision DVR2 Surveillance System (5 of 18).¶
1B6/NYC023583 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8EC75, from MCC Nice Vision DVR2 Surveillance System (6 of 18).¶
1B7/NYC023584 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZPE, from MCC Nice Vision DVR2 Surveillance System (7 of 18).¶
1B8/NYC023585 One (1) Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9Z911026, from MCC Nice Vision DVR2 Surveillance System (8 of 18).¶
1B9/NYC023586 One (1) Western Digital 500GB HDD, WD5000AAKX- 60U6AA0, S/N WCC2EJUC34CJ, from MCC Nice Vision DVR2 Surveillance System (9 of 18).¶
1B10/NYC023587 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSEZ, from MCC Nice Vision DVR2 Surveillance System (10 of 18).¶
1B11/NYC023588 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PX26, from MCC Nice Vision DVR2 Surveillance System (11 of 18).¶
1B12/NYC023589 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1Q1FX, from MCC Nice Vision DVR2 Surveillance System (12 of 18).¶
EFTA00130644¶
1B13/NYC023590 One (1) Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9T870016, from MCC Nice Vision DVR2 Surveillance System (13 of 18).¶
1B14/NYC023591 One (1) Western Digital 500GB HDD, WD5000AAKX-60U6AA0, S/N WCC2E0DE83YK, from MCC Nice Vision DVR2 Surveillance System (14 of 18).¶
1B15/NYC023592 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MT6D, from MCC Nice Vision DVR2 Surveillance System (15 of 18).¶
1B16/NYC023593 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZ07, from MCC Nice Vision DVR2 Surveillance System (16 of 18).¶
1B17/NYC023594 One (1) Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1L0YG, from MCC Nice Vision DVR2 Surveillance System (17 of 18).¶
1B18/NYC023595 One (1) Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSRR, from MCC Nice Vision DVR2 Surveillance System (18 of 18).¶
Details:¶
On August 12, 2019, FBI Special Agent (SA) requested Computer Analysis Response Team (CART) support with inventorying and processing hard drives acquired from a Nice Vision DVR2 Sureillance System located at the Metropolitan Correctional Center (MCC) in New York City, NY. SA/Forensic Examiner (FE) received custody of the hard drives and advised that the drives would be logged into Evidence, cloned and imaged. Between August 12the and August 15th, 2019, the referenced work was performed on the evidence hard drives, with details of the work outlined herein. The physical evidence hard drives were returned to SA on August 15, 2019. In addition, both the clones and images collected were entered into Evidence Control (see description below under Derivative Evidence).¶
CLONING¶
The following cloning processes were performed on August 12, 2019:¶
DRIVE 1B1 - NYC023578¶
Device: Tableau TX-1, S/N 000ECC58017139, F2882257¶
Source: Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CJJA¶
Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N S1D85PLA¶
DRIVE 1B2 - NYC023579¶
Device: Tableau TX-1, S/N 000ECC5801109B¶
Source: Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36A13K¶
Destination: Hitachi 1TB HDD, HUA722010CLA330, S/N JPW9K0N039EZLL¶
90A-NY-3151227¶
Request 112048¶
Page 2 of 8¶
EFTA00130645¶
DRIVE 1B3 - NYC023580¶
Device: Tableau TX-1, S/N 000ECC58017156¶
Source: Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CF5X¶
Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N Z1D3ZSS0¶
DRIVE 1B4 - NYC023581¶
Device: Tableau TX-1, S/N 000ECC58017194¶
Source: Seagate Barracuda 500GB, ST3500320NS, S/N 9QM8MT9P¶
Destination: Seagate Desktop 1TB HDD, ST1000DM003, S/N Z4YDJL1T¶
DRIVE 1B5 - NYC023582¶
Device: Tableau TD3–B, S/N 01D3B07E-1331¶
Source: Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36MWNK¶
Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N Z1DB81XJ¶
*Result: TD3 could not see drive #5 and the source drive was clicking, attempting LBCD.¶
Attempted FBI-CART Linux Boot CD: Version 6.1 April 2018 1 GB RAM using forensic work station Dell Precision Model P13F, F1499048, Service Tag HN3SZQ1¶
Write Blocker used: Tableau eSata Forensic Bridge, model T35es-R2, S/N: 2135E196-1235¶
*Result: FBI-CART Linux boot CD cannot read the drive. DRIVE 1B5 APPEARS TO BE DEAD.¶
DRIVE 1B6 - NYC023583¶
Device: Tableau TD3–B, S/N 01D3B07E-1331¶
Source: Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8EC75¶
Destination: Seagate Desktop HDD 1TB, ST1000DM003, S/N Z4YDHX5M¶
DRIVE 1B7 - NYC023584¶
Device: Tableau TD3–B, S/N 11D350F0-1525¶
Source: Seagate Constellation ES 500GB, ST500NM0011, S/N Z1M1PZPE¶
Destination: Seagate Barracuda 1000GB, ST1000DM003, S/N W1D48YH6¶
DRIVE 1B8 - NYC023585¶
Device: Tableau TD3–B, S/N 01D3407C-1222¶
Source: Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9Z911026¶
Destination: Western Digital 1TB HDD, WD10EADS- 00L5B1, S/N WCAU45803950¶
DRIVE 1B9 - NYC023586¶
Device: Tableau TD3-B, S/N 01D3B08D-1331¶
Source: Western Digital 500GB HDD, WD5000AAKX-60U6AA0, S/N WCC2EJUC34CJ¶
90A-NY-3151227¶
Request 112048¶
Page 3 of 8¶
EFTA00130646¶
Destination: Seagate Desktop HDD 1000GB HDD, ST100DM003, S/N Z4Y00Q48¶
DRIVE 1B10 - NYC023587¶
Device: Tableau TD3-B, S/N 11D350F6-1525¶
Source: Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSEZ¶
Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N W1D496N0¶
DRIVE 1B11 - NYC023588¶
Device: Tableau TD3-B, S/N 01D3B09E-1331¶
Source: Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PX26¶
Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N Z1DB25CT¶
DRIVE 1B12 - NYC023589¶
Device: Tableau TX-1, S/N 000ECC58017139, F2882257¶
Source: Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1Q1FX.¶
Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N W1D38Z6E.¶
DRIVE 1B13 – NYC023590¶
Device: Tableau TX-1, S/N 000ECC5801109B¶
Source: Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9T870016¶
*Result: TX-1 was reading/writing very slow; cloning job terminated.¶
Destination: Western Digital 1000GB HDD, WD10EACS-00ZJB0, S/N WCASJ1491791¶
will use attempt LBCD command line to clone:¶
Source: Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9T870016¶
Destination: Western Digital 1TB HDD, S/N WCC3F2783371.¶
*Resut: LBCD did not work. DRIVE 1B13 APPEARS TO BE DEAD.¶
DRIVE 1B14 (The swap Drive/Original was swapped out for this one)- NYC023591¶
Device:¶
Source: Western Digital 500GB HDD, WD5000AAKX-60U6AA0, S/N WCC2E0DE83YK.¶
Destination:¶
*Attempted to use both a TX-1 and TD3-B device, but neither device could read the 1B14 drive.¶
Attempted to use FBI-CART Linux Boot CD: Version 6.1 April 2018 1 GB RAM using forensic work station Dell Precision Model P13F, Service Tag HN3SZQ1, F1499048.¶
Write Blocker used: Tableau eSata Forensic Bridge, model T35es-R2, S/N: 2135E196 1235¶
90A-NY-3151227¶
Request 112048¶
Page 4 of 8¶
EFTA00130647¶
*Result: FBI-CART Linux boot CD cannot read the drive. DRIVE 1B14 APPEARS TO BE DEAD.¶
DRIVE 1B15 - NYC023592¶
Device: Tableau TX-1, S/N 000ECC58017156¶
Source: Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MT6D¶
Destination: Western Digital 1000GB HDD, WD1003FZEX-00MK2A0.¶
DRIVE 1B16 - NYC023593¶
Device: Tableau TX-1, S/N 000ECC58017194¶
Source: Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZ07¶
Destination: Seagate Barracuda 1000 GB, ST1000DM003, S/N S1D9GK9P¶
DRIVE 1B17 (THIS IS THE ORIGINAL 1B9) – NYC023594¶
Device: Tableau TD-3 –B, S/N 11D350F0-1525¶
Source: Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1L0YG¶
Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N S1D9DETC¶
*Errors indicated during cloning (see log)¶
DRIVE 1B18 (THIS IS THE ORIGINAL 1B14) – NYC023595¶
Device: Tableau TD-3 –B, S/N 01D3B07E-1331¶
Source: Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSRR¶
Destination: Seagate Barracuda 1000GB HDD, ST1000DM003, S/N 9YN162-300¶
*Errors indicated during cloning (see log)¶
IMAGING¶
Imaging processes were performed on each evidence hard drive (not including 1B5, 1B13, and 1B14), from August 13, 2019 to August 15, 2019. Images were placed onto two (2) destination hard drives, entered into Evidence as 1B43/NYC023596 and 1B42/NYC023597. All E01 images collected were verified, with the following images located on each hard drive:¶
-
HDD Destination 1/1B43/NYC023596: Contains verified E01 images of 1B1, 2, 3, 4, 6, 7, 8, 9, 10, 11, and 15.
-
HDD Destination 2/1B42/NYC023597: Contains verified E01 images of 1B12, 16, 17, and 18.
DERIVATIVE EVIDENCE GENERATED¶
The following CART Derivative Evidence was generated and entered into Evidence Control:¶
90A-NY-3151227¶
Request 112048¶
Page 5 of 8¶
EFTA00130648¶
1B22/NYC027701: One (1) Seagate Barracuda 1000GB Hard Drive, model ST1000DM003, S/N S1D85PLA, containing the Clone Copy of 1B1 hard drive (Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CJJA), collected via Tableau TX-1, S/N 000ECC58017139 (F2882257). Request ID 112048. Derivative Copy.¶
1B23/NYC027702: One (1) Hitachi 1TB Hard Drive, HUA722010CLA330, S/N JPW9K0N039EZLL, containing the Clone Copy of 1B2 hard drive (Hitachi 500GB HDD, HDS721050CLA662, S/N JP1572JE36A13K), collected via Tableau TX-1, S/N 000ECC5801109B. Request ID 112048. Derivative Copy.¶
1B24/NYC027703: One (1) Seagate Barracuda 1000GB Hard Drive, model ST1000DM003, S/N Z1D3ZSS0, containing the Clone Copy of 1B3 hard drive (Seagate Barracuda 500GB HDD, ST500DM002, S/N Z3T6CF5X), collected via TX-1, S/N 000ECC58017156. Request ID 112048. Derivative Copy.¶
1B25/NYC027704: One (1) Seagate Desktop 1TB hard drive, model ST1000DM003, S/N Z4YDJL1T, containing the Clone Copy of 1B4 hard drive (Seagate Barracuda 500GB Hard Drive, ST3500320NS, S/N 9QM8MT9P), collected via Tableau TX-1 S/N 000ECC58017194. Request ID 112048. Derivative Copy.¶
1B26/NYC027705: One (1) Seagate Desktop 1TB hard drive, model ST1000DM003, S/N Z4YDHX5M, containing the Clone Copy of 1B6 hard drive (Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8EC75), collected via Tableau TD-3 –B S/N 01D3B07E-1331. Request ID 112048. Derivative Copy.¶
1B27/NYC027706: One (1) Seagate Barracuda 1000GB Hard Drive, model ST1000DM003, S/N W1D48YH6, containing the Clone Copy of 1B7 hard drive (Seagate Constellation ES 500GB, ST500NM0011, S/N Z1M1PZPE), collected via Tableau TD3-B, S/N 11D350F0-1525. Request ID 112048. Derivative Copy.¶
1B28/NYC027707: One (1) Western Digital 1TB hard drive, WD10EADS-00L5B1, S/N WCAU45803950, containing the Clone Copy of 1B8 hard drive (Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9Z911026), collected via Tableau TD3-B, S/N 01D3407C-1222. Request ID 112048. Derivative Copy.¶
1B29/NYC027708: One (1) Seagate Desktop 1000GB HDD, ST100DM003, S/N Z4Y00Q48, containing the Clone Copy of 1B9 hard drive (Western Digital 500GB HDD, WD5000AAKX-60U6AA0, S/N WCC2EJUC34CJ), collected via Tableau TD3-B S/N 01D3B08D-1331. Request ID 112048. Derivative Copy.¶
90A-NY-3151227¶
Request 112048¶
Page 6 of 8¶
EFTA00130649¶
1B30/NYC027709: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N W1D496N0, containing the Clone Copy of 1B10 hard drive (Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSEZ), collected via Tableau TD3-B S/N 11D350F6-1525. Request ID 112048. Derivative Copy.¶
1B31/NYC027710: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N Z1DB25CT, containing the Clone Copy of 1B11 hard drive (Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PX26), collected via Tableau TD3-B S/N 01D3B09E-1331. Request ID 112048. Derivative Copy.¶
1B32/NYC027711: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N W1D48Z6E, containing the Clone Copy of 1B12 hard drive (Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1Q1FX), collected via Tableau TX-1, S/N 000ECC58017139. Request ID 112048. Derivative Copy.¶
1B33/NYC027712: One (1) Western Digital 1000GB HDD, WD1003FZEX-00MK2A0, S/N WCC3F2783519, containing the Clone Copy of 1B15 hard drive (Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MT6D), collected via Tableau TX-1, S/N 000ECC58017156. Request ID 112048. Derivative Copy.¶
1B34/NYC027713: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N S1D9GK9P, containing the Clone Copy of 1B16 hard drive (Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZ07), collected via Tableau TX-1 S/N 000ECC58017194. Request ID 112048. Derivative Copy.¶
1B35/NYC027714: One (1) Seagate Barracuda 1000GB HDD, ST1000DM003, S/N S1D9DETC, containing the Clone Copy of 1B17 hard drive (Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1L0YG), collected via Tableau TD3-B, S/N 11D350F0-1525. Request ID 112048. Derivative Copy.¶
1B36/NYC027715: One (1) Seagate Barracuda, 1000GB HDD, ST1000DM003, S/N W1D06T5L, containing the Clone Copy of 1B18 hard drive (Seagate Barracuda 500GB HDD, ST3500320NS, S/N 9QM8MSRR), collected via Tableau TD3–B, S/N 01D3B07E-1331. Derivative Copy.¶
1B42/NYC023597: One (1) Hitachi 2TB Hard Drive, 0F10311JPK3EA0P09, S/N B9GMGTYF, containing the verified E01 images NYC023589 (1B12), NYC023593 (1B16), NYC023594 (1B17), and NYC023595 (1B18). Master Copy.¶
1B43/NYC023596: One (1) WD Black 3TB hard drive, WD3003FZEX-00Z4SA0, S/N WCC13LZR579P, containing the verified E01 images NYC023578 (1B1), NYC023579 (1B2),¶
90A-NY-3151227¶
Request 112048¶
Page 7 of 8¶
EFTA00130650¶
NYC023580 (1B3), NYC023581 (1B4), NYC023583 (1B6), NYC023584 (1B7), NYC023585 (1B8), NYC023586 (1B9), NYC023587 (1B10), NYC023588 (1B11), and NYC023592 (1B15). Master Copy.¶
No further substantive work performed. All evidence items were either returned to the custody of the case agent or Evidence Control. No electronic media is being retained by the New York Division CART Unit.¶
Digitally Signed¶
Examiner:¶
SA/FE¶
Computer Analysis Response Team – New York¶
90A-NY-3151227 Request 112048 Page 8 of 8¶