EFTA00131522 90A-NY-3151227 Serial 141 FD-1036 (Rev. 10-16-2009) # UNCLASSIFIED FEDERAL BUREAU OF INVESTIGATION Import Form Form Type: OTHER - Other Date: 09/26/2019 **Title:** (U) Computer Analysis Provided by OIG Approved By: SSA Drafted By: Case ID #: 90A-NY-3151227 (U) UNSUB(S); JEFFREY EPSTEIN - VICTIM; DEATH INVESTIGATION Synopsis: (U) On August 25, 2019, OIG SA provided the computer analysis of the computers in the SHU of MCC for users Michael Thomas and Tova Noel. UNCLASSIFIED EFTA00131523

	A	B
1
2
3	Important Identifiers:
4		User:
5		Username:
6		SID:
7		SID:
8
9	Date	Time
10	8/10/2019	0:36:54
11	8/10/2019	0:38:36
12	8/10/2019	0:39:31
13	8/10/2019	0:39:31
14	8/10/2019	0:40:10
15	8/10/2019	0:40:14
16	8/10/2019	0:43:00
17	8/10/2019	0:44:19
18	8/10/2019	0:44:19
19	8/10/2019	0:44:53
20	8/10/2019	0:45:58
21	8/10/2019	0:48:20
22	8/10/2019	0:49:11
23	8/10/2019	0:50:50
24	8/10/2019	0:53:20
25	8/10/2019	0:53:31
26	8/10/2019	0:53:35
27	8/10/2019	0:53:37
28	8/10/2019	0:53:48
29	8/10/2019	0:53:55
30	8/10/2019	0:54:01
31	8/10/2019	0:54:06
32	8/10/2019	0:56:46
33	8/10/2019	0:56:49
34	8/10/2019	0:57:18
35	8/10/2019	0:59:22
36	8/10/2019	1:00:24
37	8/10/2019	1:00:28
38	8/10/2019	1:00:31
39	8/10/2019	1:00:52
40	8/10/2019	1:00:54
41	8/10/2019	1:01:21
42	8/10/2019	1:02:14
43	8/10/2019	1:02:18
44	8/10/2019	1:02:25

EFTA00131524

	A	B
45	8/10/2019	1:03:16
46	8/10/2019	1:03:02
47	8/10/2019	1:03:02
48	8/10/2019	1:13:49
49	8/10/2019	5:14:10
50	8/10/2019	6:03:30
51	8/10/2019	6:03:41
52	8/10/2019	6:12:15
53	8/10/2019	6:14:15
54	8/10/2019	6:14:21
55	8/10/2019	6:15:03
56	8/10/2019	6:15:07
57	8/10/2019	6:19:05
58	8/10/2019	6:19:05
59	8/10/2019	6:29:07
60	8/10/2019	8:55:12

EFTA00131525

	C
Timeline Analysis of Desktop Property # (Device 1)
1
2
3
4
5
6
7	Microsoft Security Identifier
8	Action
10	User BOP19012 Successfully Logged onto the System
11	User launches GroupWise (growwise.exe)
12	User saves/downloads document named "SHU 30 CHECK SHEET (CONDENSED)_1.docx" to location "C:\Users\bop19012\Documents\GroupWise\"
13	The "SHU 30 CHECK SHEET (CONDENSED)_1.docx" Word Document is also opened at this time.
14	The GroupWise program crashes
15	The GroupWise program reloads
16	Last Printed timestamp indicates "SHU 30 CHECK SHEET (CONDENSED)_1.docx" was printed
17	User saves/downloads document named "SHU Rules Metropolitan Correctional Center New York.docx" to location "C:\Users\bop19012\Desktop\"
18	The "SHU Rules Metropolitan Correctional Center New York.docx" Word Document is also opened at this time
19	User opens document named "SHU ORDERLY REQUEST 42214.rtf" from location "C:\Users\bop19012\Desktop\"
20	User launches Calculator (calc.exe)
21	User opens document named "1 - SHU LOCATOR 2019(HARDCOPY).docx" from network location "\NYMC_GRPS_SERVER\GRPS/GROUPS\SHAREDOC\SHU PAPERWORK, LOCATOR, HARDCOPY\"
22	Execution of splow64.exe by user BOP19012 indicates something was printed from the system
23	User launches Calculator (calc.exe)
24	User continues to access document named "1 - SHU LOCATOR 2019(HARDCOPY).docx" from network location
25	User launches Internet Explorer (explorer.exe)
26	User is navigated in IE to "le1:Welcome.microsoft.com/"
27	User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Homepage
28	User navigates in IE to "http://sallyport.bop.gov/inst/mym/index.jsp"
29	User navigates in IE to "http://sallyport.bop.gov/inst/mym/corrsv/index.jsp"
30	User navigates in IE to "http://sallyport.bop.gov/inst/mym/corrsv/mymofficer.jsp"
31	User opens document named "Daily Fire & Security Form1].pdf" in Internet Explorer from "http://sallyport.bop.gov/inst/mym/corrsv/docs/"
32	User launches Internet Explorer (explorer.exe)
33	User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage
34	User open Microsoft Database named "Roster.accle" at "\NYMC_APPS_SERVER\APPS\BOPAPPS\Roster\Ver3.1\"
35	User launches GroupWise (growwise.exe)
36	User searches Bing for "cycletrader"
37	User navigates in IE to "https://www.cycletrader.com/"
38	User navigates in IE to "https://www.cycletrader.com/mysaved-listings/mylistings?_i=1565413229430"
39	User searches Google for "suzuki gxsk = 750 motorcycle for sale"
40	User navigates in IE to "https://www.cycletrader.com/mysaved-listings"
41	User navigates in IE to "https://www.cycletrader.com/mysaved-listings"
42	User searches "gsx" on "https://www.cycletrader.com/"
43	User navigates in IE to "https://www.cycletrader.com/motorcycles-for-sale"

EFTA00131526

	C
45	User searches Google for "suzuki gsx-r 1000 motorcycle for sale"
46	User Internet Activity Ends
47	User activity on the system stops
48	Screen Pass is Executed by System/User - Computer System is Locked
49	User is logged off from the system
50	User BOP19012 Successfully Logged onto the System
51	User searches "shu" in Windows Explorer
52	User launches GroupWise (grpwise.exe)
53	User launches Internet Explorer (iexplorer.exe)
54	User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage
55	User searches Bing for "espn"
56	User navigates in IE to "https://www.espn.com/nfl/"
57	User Internet Activity Ends
58	User activity on the system stops
59	Screen Pass is Executed by System/User - Computer System is Locked
60	User is logged off from the system

EFTA00131527

	D	E	F
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40	&zip=08832&radius=150"
41
42
43
44

EFTA00131528

	A	B
1
2
3	Important Identifiers:
4		User:
5		Username:
6		SID:
7		SID:
8
9	Date	Time
10	8/9/2019	23:40:11
11	8/9/2019	23:40:27
12	8/9/2019	23:41:28
13	8/9/2019	23:42:55
14	8/9/2019	23:43:04
15	8/9/2019	23:43:12
16	8/9/2019	23:43:21
17	8/9/2019	23:43:27
18	8/9/2019	23:44:01
19	8/9/2019	23:45:40
20	8/9/2019	23:46:16
21	8/9/2019	23:47:06
22	8/9/2019	23:53:42
23	8/9/2019	23:53:42
24	8/10/2019	0:13:53
25	8/10/2019	3:55:42
26	8/10/2019	3:55:56
27	8/10/2019	3:55:59
28	8/10/2019	3:56:19
29	8/10/2019	3:56:27
30	8/10/2019	4:30:58
31	8/10/2019	4:31:19
32	8/10/2019	4:32:21
33	8/10/2019	4:31:28
34	8/10/2019	4:31:34
35	8/10/2019	4:33:13
36	8/10/2019	4:35:51
37	8/10/2019	4:36:02
38	8/10/2019	4:36:15
39	8/10/2019	4:36:39
40	8/10/2019	4:36:47
41	8/10/2019	4:38:45
42	8/10/2019	4:39:12
43	8/10/2019	4:48:07
44	8/10/2019	4:48:47

EFTA00131529

	A	B
45	8/10/2019	4:49:11
46	8/10/2019	4:50:47
47	8/10/2019	4:52:00
48	8/10/2019	4:55:13
49	8/10/2019	4:55:19
50	8/10/2019	4:55:25
51	8/10/2019	4:56:03
52	8/10/2019	4:56:56
53	8/10/2019	4:57:26
54	8/10/2019	5:03:07
55	8/10/2019	5:03:07
56	8/10/2019	5:11:34
57	8/10/2019	5:11:38
58	8/10/2019	5:14:02
59	8/10/2019	5:16:34
60	8/10/2019	5:17:32
61	8/10/2019	5:18:15
62	8/10/2019	5:18:18
63	8/10/2019	5:18:20
64	8/10/2019	5:18:56
65	8/10/2019	5:19:00
66	8/10/2019	5:19:06
67	8/10/2019	5:27:30
68	8/10/2019	5:27:34
69	8/10/2019	5:27:54
70	8/10/2019	5:28:05
71	8/10/2019	5:38:54
72	8/10/2019	5:39:23
73	8/10/2019	5:41:49
74	8/10/2019	5:42:06
75	8/10/2019	5:42:28
76	8/10/2019	5:42:50
77	8/10/2019	5:43:03
78	8/10/2019	5:46:06
79	8/10/2019	5:52:29
80	8/10/2019	5:53:02
81	8/10/2019	5:53:38
82	8/10/2019	5:54:39
83	8/10/2019	5:54:58
84	8/10/2019	5:58:32
85	8/10/2019	5:58:47
86	8/10/2019	6:01:55
87	8/10/2019	6:12:22
88	8/10/2019	6:16:43
89	8/10/2019	6:16:52

EFTA00131530

	A	B
90	8/10/2019	6:16:54
91	8/10/2019	6:17:05
92	8/10/2019	6:17:33
93	8/10/2019	6:18:31
94	8/10/2019	6:19:03
95	8/10/2019	6:19:10
96	8/10/2019	6:19:22
97	8/10/2019	6:19:22
98	8/10/2019	6:31:28
99	8/10/2019	10:31:40

EFTA00131531

	Timeline Analysis of Desktop Property #(Device 2)
1
2
3
4
5
6
7	Microsoft Security Identifier
8		Action
9
10	User BOP61223 Fails to Login - Incorrect Password
11	User BOP61223 Successfully Logged onto the System
12	User launches Microsoft Access (MSACCESS.EXE)
13	User launches Internet Explorer (explorer.exe)
14	User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage
15	User searches Google for "ebenefits"
16	User navigates in IE to "https://www.ebenefits.va.gov/"
17	User navigates in IE to "https://myaccess.dmdc.osd.mil/identitymanagement/authenticate.do?gotoUrl=https://myaccess.dmdc.osd.mil/opensso/SAMLAwareServlet?TARGET=https://eauth.va.gov/ebenefits"
18	User navigates in IE to "https://eauth.va.gov/ebenefits portal"
19	User searches Google for "what does it mean by VA claim contention input"
20	User navigates in IE to "http://www.benefits.va.gov/warms/docs/docs/admin21/m21_1/mr/part3/subpti/ch07/m21-liii_i_7.doc" - Attachment A1
21	User types in the URL "https://www.amazon.com/"
22	User Internet Activity Ends
23	User activity on the system stops
24	Screen Pass is Executed by System/User - Computer System is Locked
25	Computer is unlocked by user BOP61222
26	Website "www.amazon.com/" is accessed by user. Likely indicator that the web browser was left open and accessed at this time.
27	User navigates in IE to "https://10.33.56.106/TRUACESS/login.aspx"
28	User navigates in IE to "https://10.33.56.106/TRUACESS/Dashboard.aspx"
29	User navigates in IE to "https://10.33.3.57/RunTruscope.aspx"
30	User launches GroupWise (grpwise.exe)
31	User launches Internet Explorer (explorer.exe)
32	User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage
33	User searches Google for "epp"
34	User navigates in IE to "https://www.nfc.usda.gov/personal/"
35	User searches Bing for "calendar 2019"
36	User searches Google for "unum insurance"
37	User navigates in IE to "https://www.unum.com/"
38	User navigates in IE to "https://www.unum.com/employees"
39	User navigates in IE to "https://www.unum.com/employees/benefits"
40	User navigates in IE to "https://www.unum.com/employees/benefits/disability-insurance"
41	User searches Google for "usaJobs"
42	User navigates in IE to "https://www.usajobs.gov/Search/"
43	User searches Google for "furniture bronx my"
44	User navigates in IE to "https://www.mybobs.com/stores/new-york/bronx-co-op-city"

EFTA00131532

C
46	User navigates in IE to "https://www.mybobs.com/c/bedroom-sets"
47	User navigates in IE to "https://www.mybobs.com/furniture/bedroom/bedroom-sets/majestic-king-bedroom-set/p/20023186"
48	User searches Google for "ashleys furniture"
49	User launches Internet Explorer (explorer.exe)
50	User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage
51	User searches Google for "ashleys furniture"
52	User navigates in IE to "https://www.ashelyfurniture.com/c/furniture/sets/bedroom-sets/"
53	User types in the URL "https://www.raymourflanigan.com/"
54	User navigates in IE to "https://www.raymourflanigan.com/hempstead-king-bed-597155007.aspx"
55	User Internet Activity Ends
56	User activity on the system stops
57	User launches Internet Explorer (explorer.exe)
58	User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage
59	User searches for Last Name "noel" in BOP Staff Directory -- https://sallyport.bop.gov/StaffDirectory/execute/sdStaffDirectory?action=sd_action_search&facilityCode=&lastName=noel&firstName=&re
60	User launches GroupWise (grwise.exe)
61	User launches Microsoft Access (MSACCESS.EXE)
62	User launches Internet Explorer (explorer.exe)
63	User opens Microsoft Database named "Raster.acce" at "file:///K/BOPAPPS/Roster/V3.1/Roster.acce"
64	User navigates in IE to "//10.33.56.10E/TRUACESS/login.aspx"
65	User navigates in IE to "//10.33.56.10E/TRUACESS/Dashboard.aspx"
66	User navigates in IE to "//10.33.56.10E/truaccess/ApplicationLauncher.aspx"
67	User navigates in IE to "//10.33.3.57/Dashboard.aspx"
68	User launches Internet Explorer (explorer.exe)
69	User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage
70	User searches Google for "activity on the system"
71	User searches Google for "searchs.google.com"
72	User navigates in IE to "//imfromdriftwood.com/tag"
73	User navigates in IE to "//https://pose.fx.fandom.com/wiki/"
74	User searches Google for "searchs.google.com"
75	User navigates in IE to "//https://imfromdriftwood.com/tag"
76	User navigates in IE to "//https://www.cnbc.com/2019/08/09/documents-released-about-jeffrey-epstein-and-ghislaine-maxwell.html"
77	User navigates in IE to "//https://www.google.com/url?a=t&rct=j&q=&es=c&source=web&cd=2&ved=2ah1KEwJD02FgvijiAhVKT98KHQkdZwQOPADMAF6BAgAEA&url=https%3A%2F%2Fktla.com%2
78	User navigates in IE to "latest on epstein in jail"
79	User navigates in IE to "latest on omar amanat"
80	User navigates in IE to "https/mypost.com/tag/omar-amanat"
81	User navigates in IE to "www.justice.gov/usn-sdy/py/former-owner-and-manager-dubai-based-investment-fund-found-guilty-manhattan-federal"
82	User navigates in IE to "www.law360.com/articles/1148326/ex-cfo-of-fraud-ridden-video-startup-spared-more-prison"
83	User searches Google for "latest on omar amanat"
84	User opens file from IE named "myds_1_2015-cr-00536-446092-00792[1].pdf" -- SENTENCING MEMORANDUM OF OMAR AMANAT
85	User launches GroupWise (grwise.exe)
86	Screen Pass is Executed by System/User - Computer System is Locked
87	Computer is unlocked by user BOP61232
88	User launches Internet Explorer (explorer.exe)

EFTA00131533

	C
90	User is navigated in IE to "http://sallyport.bop.gov/" -- Internet Explorer Hompage
91	User searches Google for "law enforcement discounts"
92	User navigates in IE to "https://www.badgeddiscounts.com/"
93	User navigates in IE to "https://proudpolicewife.com/the-mega-list-of-law-enforcement-discounts/"
94	User searches Google for "law enforcement discounts"
95	User navigates in IE to "https://www.verizonwireless.com/support/first-responders-discounts-faqs/"
96	User Internet Activity Ends
97	User activity on the system stops
98	Screen Pass is Executed by System/User - Computer System is Locked
99	User is logged off from the system

EFTA00131534

	D	E	F	G	H	I	J	K	L	M	N	O	P	Q	R	S	T
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17	refits-portal™
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

EFTA00131535

	D	E	F	G	H	I	J	K	L	M	N	O	P	Q	R	S	T
45
46
47
48
49
50
51
52
53
54
55
56
57
58 lordsPerPage=25
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78 f2019%2F08%2Fjeffrey-epstein-repeatedly-refused-to-answer-questions-about-allegations-he-orchestrated-sex-trafficking-ring-documents%2F&usg=AOvVaw3BUNSO6WDizbkD9ie_9K5C'
79
80
81
82
83
84
85
86
87
88
89