EFTA00131950¶
18-1 (Rev. 08-15-2017)¶
UNCLASSIFIED¶
Federal Bureau of Investigation Digital Evidence Laboratory¶
ERF Building 27958A Quantico, VA 22135¶
REPORT OF EXAMINATION¶
Date: June 16, 2021¶
Case ID: 090A-NY-3151227¶
Request No.: HQQ190816001¶
Request Date: August 16, 2019¶
| Ref. No: | Serial 58 |
| Title: | UNSUB(S);JEFFREY EPSTEIN - VICTIM;DEATH INVESTIGATION |
Date item(s) received: August 16, 2019¶
Item(s) submitted:¶
HQQ019594: DVR, Dell, PowerEdge R420, 5BMQZ12, 1B20, One (1) DVR System Controller (Examined)¶
HQQ019333: Hard Drive, Dell, WD5003ABYX-18WERA0, WMAYP0DFPY4F, 1B20, One (1) hard disk drive from Bay 1 of DVR System Controller. (Examined)¶
HQQ019334: Hard Drive, Dell, WD5003ABYX-18WERA0, WMAYP0DNCDAV, 1B20, One (1) hard disk drive from Bay 2 of DVR System Controller. (Examined)¶
HQQ019595: DVR, NICE Systems, SA-6640S, F96168201-004, 1B19, One (1) DVR Disk Array (DVR 2) (Examined)¶
HQQ019596: DVR, NICE Systems, Nicevision PRO (NP-2000), 43144902, 1B19, One (1) DVR Disk Array Controller (DVR 2) (Examined)¶
HQQ019331: Hard Drive, Seagate, ST3320620AV, 9QFCN325, 1B19, One (1) hard disk¶
Page 1 of 9¶
An Accredited Laboratory Since January 16, 2007¶
UNCLASSIFIED¶
EFTA00131951¶
UNCLASSIFIED¶
| drive from top bay of DVR 2 Disk Array Controller. (Examined) | |
|---|---|
| HQQ019597: | DVR, NICE Systems, Premium 8600, 232476, 1B21, One (1) DVR Disk Array (DVR 1) (Examined) |
| HQQ018772: | Hard Drive, Western Digital, WD3200AAJB, WCAV21723809, From Bay 1 of HQQ019597 (Examined) |
| HQQ018773: | Hard Drive, Seagate, ST3320620AV, 9QF7PFHZ, From Bay 2 of HQQ019597 (Examined) |
| HQQ018774: | Hard Drive, Seagate, ST3320620AV, 9QF7P84L, Drive from Bay 3 of HQQ019597 (Examined) |
| HQQ018775: | Hard Drive, Seagate, ST3320620AV, 9QFCM8PR, From Bay 4 of HQQ019597 (Examined) |
| HQQ018776: | Hard Drive, Seagate, ST3320620AV, 9QF649J4, From Bay 5 of HQQ019597 (Examined) |
| HQQ018777: | Hard Drive, Seagate, ST3320620AV, 9QF7NJTG, From Bay 6 of HQQ019597 (Examined) |
| HQQ018778: | Hard Drive, Seagate, ST3320620AV, 9QFB0S6N, From Bay 7 of HQQ019597 (Examined) |
| HQQ018779: | Hard Drive, Seagate, ST3320620AV, 9QFB0P1Q, From Bay 8 of HQQ019597 (Examined) |
| HQQ018780: | Hard Drive, Seagate, ST3320620AV, 9QF7P8W1, From Bay 9 of HQQ019597 (Examined) |
| HQQ018781: | Hard Drive, Seagate, ST3320620AV, 9QF7PFPY, Bay 10 of HQQ019597 (Examined) |
| HQQ018782: | Hard Drive, Seagate, ST3320620AV, 9QFCM7CS, From Bay 11 of HQQ019597 (Examined) |
| HQQ018783: | Hard Drive, Seagate, ST3320620AV, 9QF9Q0F5, From Bay 12 of HQQ019597 (Examined) |
| HQQ018784: | Hard Drive, Maxtor, MaXLine II, A830RYBE, Drive from Bay 13 (Examined) |
| HQQ018785: | Hard Drive, Western Digital, WD3200AAJB-00J3A0, WCAV21023754, From Bay 14 of HQQ019597 (Examined) |
| HQQ018786: | Hard Drive, Seagate, ST3320620AV, 9QFCJV3P, Bay 15 of HQQ019597 (Examined) |
| HQQ018787: | Hard Drive, Seagate, ST3320620AV, 9QF7N0SX, From Bay 16 of HQQ019597 (Examined) |
| HQQ019598: | DVR, NICE Systems, Nicevision PRO (NP-2000), 43144901, 1B21, One (1) |
Page 2 of 9¶
UNCLASSIFIED¶
EFTA00131952¶
UNCLASSIFIED¶
| DVR 1 Disk Array Controller(DVR 1)(Examined) | |
| HQQ018525: | Hard Drive, Maxtor,DiamondMax 10(6L080P0),L25C8D3G,1B21,One(1)hard disk drive from top bay of DVR 1 Disk Array Controller.(Examined) |
| HQQ018526: | Hard Drive, Maxtor,DiamondMax 10(6L080P0),L25CF5QG,1B21,One(1)hard disk drive from bottom bay of DVR 1 Disk Array Controller.(Examined) |
| HQQ019599: | Hard Drive, Seagate,ST500DM002,Z3T6CJJA,1B1,One(1)hard drive(E6516194)(Examined) |
| HQQ019600: | Hard Drive,Hitachi,HDS721050CLA662,JP1572JE36A13K,1B2,One(1)hard drive(E6516195)(Examined) |
| HQQ019601: | Hard Drive,Seagate,ST500DM002,Z3T6CF5X,1B3,One(1)hard drive(E6516196)(Examined) |
| HQQ019602: | Hard Drive,Seagate,ST3500320NS,9QM8MT9P,1B4,One(1)hard drive(E6516197)(Examined) |
| HQQ019603: | Hard Drive,Hitachi,HDS721050CLA662,JP1572JE36MWNK,1B5,One(1)hard drive(E6516198)(Examined) |
| HQQ019604: | Hard Drive,Seagate,ST3500320NS,9QM8EC75,1B6,One(1)hard drive(E6516199)(Examined) |
| HQQ019605: | Hard Drive,Seagate,ST500NM0011,Z1M1PZPE,1B7,One(1)hard drive(E6516200)(Examined) |
| HQQ019606: | Hard Drive,Western Digital,WD5000AVDS,WCAV9Z911026,1B8,One(1)hard drive(E6516201)(Examined) |
| HQQ019607: | Hard Drive,Western Digital,WD5000AAKX,WCC2EJUC34CJ,1B9,One(1)hard drive(E6516202)(Examined) |
| HQQ019608: | Hard Drive,Seagate,ST3500320NS,9QM8MSEZ,1B10,One(1)hard drive(E6516203)(Examined) |
| HQQ019609: | Hard Drive,Seagate,ST3500641A,3PG00Q5E,Partial image of DVR 2system drive(Examined) |
| HQQ019610: | CD-R,Photos of bad drives.(Examined) |
| HQQ019611: | Hard Drive,Seagate,ST500NM0011,Z1M1PX26,1B11,One(1)hard drive(E6516204)(Examined) |
| HQQ019612: | Hard Drive,Seagate,ST500NM0011,Z1M1Q1FX,1B12,One(1)hard drive(E6516205)(Examined) |
| HQQ019613: | Hard Drive,Western Digital,WD5000AVDS,WCAV9T870016,1B13,One(1)hard drive(E6516206)(Examined) |
Page 3 of 9¶
UNCLASSIFIED¶
EFTA00131953¶
UNCLASSIFIED¶
| HQQ019614: | Hard Drive, Western Digital, WD5000AAKX, WCC2E0DE83YK, 1B14, One (1) hard drive (E6516207) (Examined) |
|---|---|
| HQQ019615: | Hard Drive, Seagate, ST3500320NS, 9QM8MT6D, 1B15, One (1) hard drive (E6516208) (Examined) |
| HQQ019616: | Hard Drive, Seagate, ST500NM0011, Z1M1PZ07, 1B16, One (1) hard drive (E6516209) (Examined) |
| HQQ019617: | Hard Drive, Seagate, ST500NM0011, Z1M1L0YG, 1B17, One (1) hard drive (E6516210) (Examined) |
| HQQ019618: | Hard Drive, Seagate, ST3500320NS, 9QM8MSRR, 1B18, One (1) hard drive (E6516211) (Examined) |
| HQQ019619: | Hard Drive, Seagate, ST1000DM003, S1D85PLA, 1B22, Clone of 1B1 (E6515200) (Examined) |
| HQQ019620: | Hard Drive, Hitachi, HUA722010CLA330, N039EZLL, 1B23, Clone of 1B2 (E6515201) (Examined) |
| HQQ019621: | Hard Drive, Seagate, ST1000DM003, Z1D3ZSS0, 1B24, Clone of 1B3 (E6515202) (Examined) |
| HQQ019622: | Hard Drive, Seagate, ST1000DM003, Z4YDJL1T, 1B25, Clone of 1B4 (E6515203) (Examined) |
| HQQ019623: | Hard Drive, Seagate, ST1000DM003, Z4YDHX5M, 1B26, Clone of 1B6 (E6515204) (Examined) |
| HQQ019624: | Hard Drive, Seagate, ST1000DM003, W1D48YH6, 1B27, Clone of 1B7 (E6515205) (Examined) |
| HQQ019625: | Hard Drive, Western Digital, WD10EADS, WCAU45803950, 1B28, Clone of 1B8 (E6515206) (Examined) |
| HQQ019626: | Hard Drive, Seagate, ST1000DM003, Z4Y00Q48, 1B29, Clone of 1B9 (E6515207) (Examined) |
| HQQ019627: | Hard Drive, Seagate, ST1000DM003, W1D496N0, 1B30, Clone of 1B10 (E6516228) (Examined) |
| HQQ019628: | Hard Drive, Seagate, ST1000DM003, Z1DB25CT, 1B31, Clone of 1B11 (E6516229) (Examined) |
| HQQ019629: | Hard Drive, Seagate, ST1000DM003, W1D48Z6E, 1B32, Clone of 1B12 (E6516230) (Examined) |
| HQQ019630: | Hard Drive, Western Digital, WD1003FZEX, WCC3F2783519, 1B33, Clone of 1B15 (E6516231) (Examined) |
| HQQ019631: | Hard Drive, Seagate, ST1000DM003, S1D9GK9P, 1B34, Clone of 1B16 |
Page 4 of 9¶
UNCLASSIFIED¶
EFTA00131954¶
UNCLASSIFIED¶
| (E6516232) (Examined) | |
| HQQ019632: | Hard Drive, Seagate, ST1000DM003, S1D9DETC, 1B35, Clone of 1B17(E6516233) (Examined) |
| HQQ019633: | Hard Drive, Seagate, ST1000DM003, W1D06T5L, 1B36, Clone of 1B18(E6516234) (Examined) |
Summary:¶
Per Electronic Communication (EC) dated 8/26/2019, Special Agent (¶
transferred the submitted specimens from the New York field office to the Operational Technology Division/Digital Forensics Analysis Unit (OTD/DFAU) in Quantico for examination. The specimens were received by the Computer Analysis Response Team (CART) for analysis.¶
Per discussion with CART Laboratory Supervisor on 8/19/2019, the Digital Video Recorder (DVR) system is to be assembled to allow export of videos contained on the system.¶
The DVR system consisted of a main controller and 2 disk arrays, labeled as DVR 1 and DVR 2.¶
DVR 1 was assembled successfully and made available for export of videos. Video Specialis performed exports based on requests made by the NY investigative team. On 12/19/2019, DVR 1 failed due to hardware issues. Contact with the vendor and attempts to use replacement parts were unsuccessful in restoring the disk array to a usable state.¶
DVR 2 contained 3 hard disk drives that were repaired by Advanced Data Recovery Specialist Dan h. However, DVR 2 was never able to be assembled successfully. A review of the logs on the DVR 2 controller indicated catastrophic disk failures before receipt by the FBI.¶
A master copy of the images of the hard disk drives contained in the DVR system were placed on to 3 hard drives for storage (labeled as HQQ026637-HQQ026639).¶
Details of Examination:¶
The dates of this examination were August 20, 2019 through May 24, 2021.¶
HQQ190816001¶
090A-NY-3151227¶
Page 5 of 9¶
UNCLASSIFIED¶
EFTA00131955¶
UNCLASSIFIED¶
The submitted items were parts of a DVR system, overview as follows:¶
| 1B# | HQQ# | Item | Contents |
| 1B20 | HQQ019594 | Main Controller | Contained 2 drives |
| 1B21(2 of 2) | HQQ019598 | DVR 1 Controller | Contained 2 drives |
| 1B21(1 of 2) | HQQ019597 | DVR 1 Disk Array | Contained 16 drives |
| 1B19(2 of 2) | HQQ019596 | DVR 2 Controller | Contained 1 drive |
| 1B19(1 of 2) | HQQ019595 | DVR 2 Disk Array | Array is empty |
The hard disk drives contained in the units were write blocked and forensic images created as follows:¶
Main Controller - Forensic images of the 2 drives were created to a forensically clean network share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by s.¶
DVR 1 Controller - The top bay drive was repaired by Recovery Specialist . Forensic images of the 2 drives were created to a forensically clean network share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by s.¶
DVR 1 Disk Array - Forensic images of the 16 drives were created to a forensically clean network share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by FE¶
DVR 2 Controller - Forensic image of the 1 drive was created to a forensically clean network share in Quantico for archive. A forensic copy of the drive (clone) was also created on an additional physical drive to be used in the unit for assembly. These actions were performed by¶
DVR 2 Disk Array - The 16 drives originally contained in the unit were provided to the NY FO. Forensic images of the 16 drives were created to a forensically clean network share in New York for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by NY FE’s and provided to the CART team in Quantico.¶
The DVR system was assembled using the clones and powered on.¶
The Main Controller started up successfully and was accessed using Administrator password ” as provided by the vendor. The NICE suite of software, which provides visibility into the¶
HQQ190816001¶
090A-NY-3151227¶
Page 6 of 9¶
UNCLASSIFIED¶
EFTA00131956¶
UNCLASSIFIED¶
setup and recordings on DVR 1 and DVR 2 was accessed using password ” to gain access to the administrator functions. A review indicated that roughly half of the camera assignments were allotted to each DVR.¶
DVR 1 started up successfully and recordings were available for export through the Main Controller software interface. DVR 2 did not start successfully.¶
On 9/18/2019, a meeting was conducted with DVR vendor Technical Support Representative of SigNet Technologies. I provided an overview of the operation of the system. A review of the DVR 2 controller logs by and Senior Advisor indicated that there had been catastrophic disk failures in the array and no recordings would have been available after 7/29/2019. and Computer Scientist were provided access to the beginning sectors of the 16 drives to see if the structure would indicate clues of a possible rebuild. None were apparent.¶
Video Specialist was provided access to the DVR software and performed exports of the available recordings on DVR 1 based on investigative team requests.¶
On 12/19/2019, Video Specialist reported beeping from the disk array and inability to use the software to continue to perform exports. A review of the unit indicated memory errors. Attempts at reseating memory board and RAM were unsuccessful. The vendor was contacted for replacement parts, but none were available due to the age of the unit. Lab Supervisor purchased and provided exemplar memory board and RAM. Several attempts to restore the unit to working order with replacement parts were unsuccessful and eventually exhausted.¶
The DVR system original items and clones were returned to NY FO. Master copies of the Main Controller, DVR 1 images, DVR 2 repaired drive images, and video exports were placed on to hard disk drives (HQQ026637-HQQ026639) for storage. NY CART Examiners will perform archive of the DVR 2 images located on the NY FO network share.¶
Derivative Evidence/Copies:¶
| HQQ018788: | Hard Drive, Western Digital, WD3200AAJB,WCARW3862711, Clone of HQQ018772 Bay 1 |
| HQQ018789: | Hard Drive, Western Digital, WD3200AAJB,WCARW4061457, Clone of HQQ018773 Bay 2 |
| HQQ018790: | Hard Drive, Western Digital, WD3200AAJB,WCARW4061578, Clone of HQQ018774 Bay 3 |
| HQQ018791: | Hard Drive, Western Digital, WD3200AAJB,WCARW3816411, Clone of HQQ018775 Bay 4 |
| HQQ018792: | Hard Drive, Western Digital, WD3200AAJB,WCARW3886572, Clone of HQQ190816001090A-NY-3151227 |
Page 7 of 9¶
UNCLASSIFIED¶
EFTA00131957¶
UNCLASSIFIED¶
| HQQ018776 Bay 5 | |
|---|---|
| HQQ018793: | Hard Drive, Western Digital, WD3200AAJB, WCARW3914931, Clone of HQQ018777 Bay 6 |
| HQQ018794: | Hard Drive, Western Digital, WD3200AAJB, WCARW3809038, Clone of HQQ018778 Bay 7 |
| HQQ018795: | Hard Drive, Western Digital, WD3200AAJB, WCARW4064417, Clone of HQQ018779 Bay 8 |
| HQQ018796: | Hard Drive, Western Digital, WD3200AAJB, WCARW3816301, Clone of HQQ018780 Bay 9 |
| HQQ018797: | Hard Drive, Western Digital, WD3200AAJB, WCARW3915042, Clone of HQQ018781 Bay 10 |
| HQQ018798: | Hard Drive, Western Digital, WD3200AAJB, WCARW3809320, Clone of HQQ018782 Bay 11 |
| HQQ018799: | Hard Drive, Western Digital, WD3200AAJB, WCARW3816426, Clone of HQQ018783 Bay 12 |
| HQQ018800: | Hard Drive, Western Digital, WD3200AAJB, WCARW3809296, Clone of HQQ018784 from Bay 13 of HQQ019597 |
| HQQ018801: | Hard Drive, Western Digital, WD3200AAJB, WCARW3809224, Clone of HQQ018785 Bay 14 |
| HQQ018802: | Hard Drive, Western Digital, WD3200AAJB, WCARW3755653, Clone of HQQ018786 Bay 15 |
| HQQ018803: | Hard Drive, Western Digital, WD3200AAJB, WCARW3816498, Clone of HQQ018787 Bay 16 |
| HQQ019332: | Hard Drive, Seagate, ST3500630A, 9QG23RDP, Clone of HQQ019331(top bay of DVR2 Disk Array Controller) |
| HQQ019335: | Hard Drive, Western Digital, WD1001FALS-41Y6A1, WCATR7962678, Clone of HQQ019333 (Bay 1 of Main Controller) |
| HQQ019336: | Hard Drive, Western Digital, WD15EVDS-73V9B1, WMAVU4005952, Clone of HQQ019334 (Bay 2 of Main Controller) |
| HQQ019337: | Hard Drive, Maxtor, DiamondMax 6L300R0, L60YGFBG, Clone of HQQ018526 |
| HQQ019353: | Hard Drive, Maxtor, 6L200PD, L41RWHTH, Clone of repaired HQQ018525 |
| HQQ019354: | Hard Drive, Seagate, ST3500630AS, 9QG4FNAD, Clone of repaired 1B17 |
| HQQ019355: | Hard Drive, Toshiba, dt01aca050, 74J2Z3GAS, Clone of repaired 1B18 |
Page 8 of 9¶
UNCLASSIFIED¶
EFTA00131958¶
UNCLASSIFIED¶
| HQQ019356: | Hard Drive, Seagate, ST3500410SV, 6VM5VRFN, Clone of repaired 1B14 |
| HQQ019361: | Hard Drive, Seagate, ST500NM0011, Z1M16CC0, Clone of repaired 1B13 |
| HQQ019363: | Hard Drive, Seagate, ST500NM0011, Z1M16CMQ, Clone of repaired 1B5 |
| HQQ026637: | Hard Drive, Western Digital, WD20EARS-22MVWB0, WCAZA6894206, Contains Master Copy of DVR Main Controller images. |
| HQQ026638: | Hard Drive, Seagate, ST100000VN0008, ZPW0KE1R, Contains Master Copy of DVR 1 images. |
| HQQ026639: | Hard Drive, Western Digital, WD4003FZEX-00Z4SA0, WMC5D0D9K9R0, Contains Master Copy of DVR 2 controller, DVR 2 repaired drive images, and Video Exports. |
Disposition of Items:¶
All original evidence items and derivative evidence items including Master Copies (HQQ026637-HQQ026639) were submitted to OTD Evidence Control for delivery to the contributing office. No electronic evidence is being retained at DFAU Headquarters. The notes of this examination are being placed in a Digital Evidence Laboratory (DEL) file jacket and being retained in the FBI OTD file.¶
HQQ190816001 090A-NY-3151227¶
Page 9 of 9¶
UNCLASSIFIED¶