I know you already got this, just wanted to confer with you as to what is going on with all this. Feel like you, me, and need to chat and see what is what. I’m thinking that this started before the case took a turn yet is still moving in the same direction. In other words, do we really need to be doing this? Seems to me that I should be taking all my marching orders from and .¶
3503-027¶
Page 1 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00001994¶
EFTA00157176¶
Subject: RE: Epstein search warrant documents¶
Will do.¶
Understood, and thanks for letting us know. Let’s keep in touch both on timing and also on whether there’s a way to identify and categorize what’s already been produced, or if we’ll need to just get all the raw data at this stage and go from there.¶
Subject: RE: Epstein search warrant documents¶
Unfortunately, recent events and our staffing levels have conspired to put a kink in just about everything. If we can’t make heads or tails of the stuff I’ve already produced, we’ll do it again. They have told us that our staffing levels will be steadily increasing over the next few weeks, but I’m going to have to push back my estimate by a week or 2. Sorry about that. My next day in the office is Thursday, so I’ll be able to see if I can easily identify what I already gave you and marry it to a reliable identifier.¶
Thanks for this update – we’ll take a look and circle back if any questions.¶
Separately, to follow up on a question from the May 15 email below, the list has just five devices as still pending to be transferred to us, and I think it’s right that the plan is to reproduce all the¶
3503-027¶
Page 2 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00001995¶
EFTA00157177¶
materials so that we can get them in searchable format, but just wanted to confirm? Currently, we aren’t able to match any of the prior productions to specific devices – so if we’re able to match them up by Bates number now, that might work, but otherwise I think it makes sense for us to get everything. But let us know if any issue with that.¶
And related to that question, are we still on track to get the full range of data in the next week or so? I don’t think we’ve gotten any updates on that status in the past few weeks, and we’re eager to be able to start reviewing.¶
thanks again,¶
Updated item descriptions. Just a side note, many thumb drives and SD cards will not have a serial number visible externally, but will report one through our tools. I included those electronically reported serial numbers. Any questions, let me know.¶
Subject: RE: Epstein search warrant documents¶
3503-027¶
Page 3 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00001996¶
EFTA00157178¶
Subject: Re: Epstein search warrant documents¶
Here is The listing of all the evidence gathered in NY that I have. I added some columns to guide you to the unique numbers CART NY uses fro their evidence. The template wasn’t a slam¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00001997¶
EFTA00157179¶
dunk over, so I did what I could to convey the information. If you are confused by anything, please let me know. In the column for approximate size, it is in GB, totaled at the bottom and converted to TB. In the materials contained column, I put what load file group the data was transferred over in (Mac, Windows, Loose Media, IDE, or Blacklight) If there is no entry in that column, that data has yet to be transferred. There are 2 Macs and a DVR you don’t have as well as an iPhone and an iPad. IF the descriptions are a bit light, let me know and I’ll do what I can to beef them up. I will get you the Island stuff tomorrow.¶
Respectfully, I think there are some miscommunications here – all we have asked is to receive the materials in a format such that we can view them using a system we have access to. We’re not able to get web-enabled access through any FBI tool, so we asked for the materials to be transferred in a loadable format so we could put them on Relativity, which both we and the agents can access.¶
We’re required to have the files in a format that we can produce them to defense counsel. I’ve done that in many other cases and it hasn’t previously been an issue. My understanding from is that the best way to do it now is just for us (the U.S. Attorney’s Office) to get the original files, which our vendor will process—by which I just mean converting into file formats that are loadable onto Relativity. It doesn’t really have anything to do with the taint review—we have to have access to the docs in our systems for discovery purposes.¶
And we were happy to get the materials as they were processed, but when we received the 1.1 million documents earlier this year, they were in a format that wasn’t usable for the reasons described in the email I sent on March 9. Again, I understand from that the best way forward is to just get copies of the materials in their original formats, which I understand will be segregated and designated by device. That should work for us! I was just trying to understand the approach, as well as the timeline.¶
thanks,¶
3503-027¶
Page 5 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00001998¶
EFTA00157180¶
Subject: Re: Epstein search warrant documents¶
Just to be clear. The US Attorney’s Office (or it’s contractors) are not “processing” anything. You are taking files that I will be extracting from processed evidence and putting them into an E-Discovery tool (Relativity) to do a taint review.¶
Relativity is NOT a forensic tool. It is incapable of dealing with many things that are found forensically on a computer like free space, slack space, and system files to name a few. When we started this, and you insisted you do the taint review in Relativity, I warned you that it was adding months worth of work on top of what was already done, and that Relativity was incapable of viewing everything. You insisted we do it this way. So now and I have come up with a way to fit this round peg into this square hole. We will get it done.¶
Sorry it has taken so long, but we are talking about terabytes worth of data over multiple forms of digital evidence. Phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers. We have gotten past encryption on multiple devices. When we review devices on such large cases, we usually do it piece by piece as things are processed, I was unaware that you didn’t want to review as things were processed, that you wanted to do it “all at once”, so that added to the delay. Sorry for that. Just a differentiation of methodology I suppose.¶
and I feel confident that the method we have come up with will be more consistent and preserve the attribution of files to devices and links of e-mails to attachments that the load file generation that I did a while back was lacking.¶
FBI NY CART Coordinator¶
Senior Examiner¶
Sent: Tuesday, May 12, 2020 11:33 AM¶
3503-027¶
Page 6 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00001999¶
EFTA00157181¶
Subject: RE: Epstein search warrant documents¶
Okay, so just to check, you both think that there is not a need to do a test run? You’re both comfortable with just basically sending us copies of everything? I don’t totally understand why we couldn’t have done that eight months ago, but regardless of the passage of time, I want to make sure we understand so we can report to our supervisors. I assume that means that we (at the U.S.¶
Office and through contractors) will therefore need to do all the processing ourselves, correct? And thanks again to you both.¶
Subject: RE: Epstein search warrant documents¶
Like said in his earlier email. It will be the raw data and it will be marked so it is easier to attribute it to a particular device. Problem now is how to get the data to since he is teleworking.¶
I have no doubt you do, but can you please tell us what that plan is? Thanks!¶
Subject: RE: Epstein search warrant documents¶
I will use the spreadsheet, no problem. and I ironed out all the details. We’ve got a good¶
3503-027¶
Page 7 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00002000¶
EFTA00157182¶
plan moving forward that will meet your needs.¶
On May 12, 2020 10:34 AM,’¶
wrote:
¶
it would be very helpful for us if you could please use the attached spreadsheet in transmitting that info so we make sure we get all the info we need. I think you had previously sent us a list of certain information that unfortunately wasn’t helpful for us, so we want to make sure we’re all on the same page.¶
In terms of data transfer, are you just sending a literal copy of all the raw data, and we’ll process and upload it on our end? I ask to make sure we don’t lose any searchability – when FBI sent versions before, it had already been processed. I think what we talked about on the phone a month ago was getting, for example, data from one device to make sure it transfers correctly, before sending over literally everything – is that still the plan?¶
thanks,¶
Me and just finished our phone call regarding the data. will put together a list of the all of the data and where the data was collected. I will work to send some hard drives to so he can begin to copy the data and send it to us. I will need to figure out a way to get the data off of the hard drives.¶
Please let us know if there are any questions.¶
Thank you.¶
From:¶
(USANYS) ·¶
Sent: Friday, May 8, 2020 2:15 PM¶
3503-027¶
Page 8 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00002001¶
EFTA00157183¶
Subject: RE: Epstein search warrant documents¶
Okay thanks – please do let us know if at any point that changes, otherwise we’ll look forward to being able to review the returns in early June. Thanks again.¶
Subject: RE: Epstein search warrant documents¶
There has been talk of us returning to normal soon, so I don’t think it will effect the timeline I initially gave you. If it does, I’ll let you know.¶
On the returns themselves, do the changes you mentioned mean that the estimate of a month from now for complete transmission of the search warrant returns is no longer likely? If so could you please let us know what the current estimate would be, so we can factor that in? Thanks very much.¶
3503-027¶
Page 9 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00002002¶
EFTA00157184¶
Subject: RE: Epstein search warrant documents¶
Sorry for the delay, they reduced us to 1 day a week, so things have been stretched out by a factor of 5. I will be back in the office on Thursday and will be able to get you the list then as I have to access some of our systems to do so.¶
Also, please reach out to me at one of the numbers below so we can brain storm. Thanks.¶
Following up on the below, I think you had said you expected to be able to get us a list of the devices seized from the search warrants at Epstein’s residences in New York and the USVI, as well as from his person upon arrest, in about a month (during our conference call a month ago) – so wanted to check if we can still expect that very soon? We’re waiting on that list to be able to do an updated search warrant on all of those devices. Please let us know the current timeline – and also the current timeline on producing the results from those August and September searches? I think you and were going to coordinate on that, and you had mentioned you expected we’d have it a couple months from our call, which would be about a month from now. Wanted to make sure we’re still on track.¶
Subject: RE: Epstein search warrant documents¶
3503-027¶
Page 10 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00002003¶
EFTA00157185¶
Ok let’s plan on 11am tomorrow morning, I am trying to get an FBI line with a larger capacity but I won’t know until tomorrow am. I will push it out when confirmed.¶
Thanks¶
Yes, I can do anytime tomorrow, and can also join anytime tomorrow. So whenever is good on your end.¶
Also, we can host a conference call, but only up to six lines at a time – so if FBI has larger capacity than that let us know, otherwise I’d propose we do:¶
Are you available tomorrow for a conference call to discuss this issue?¶
3503-027¶
Page 11 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00002004¶
EFTA00157186¶
Following up on this from a month ago – I know we’re living in a different world than what existed four weeks ago, but are you at all able to assist while working remotely? This has been pending for almost two months and we still don’t have a very basic list of each device or item that was seized and searched, or for which of those we’ve received materials. We’re happy to have a call if that would be useful, but as a first step the most basic thing we’re looking for is the info in the template spreadsheet we sent earlier (that’s also attached).¶
thanks,¶
Subject: RE: Epstein search warrant documents¶
Unfortunately I don’t think this is very helpful to us. Did you take a look at the example spreadsheet I sent on 2/24? The excel file you sent has descriptions that don’t match up to the items listed in the search warrant returns (that we sent on 2/23), and we don’t have the 1B or CART numbers to be able to cross-reference. We also can’t tell what you mean by “loose media” without a specific comparison to what was seized, we don’t know which items you’re referring to as “Windows machines,” and we can’t tell whether the entirety of any particular item has been transferred, or just partial. For example, it looks like we have gotten very, very few image files, which is surprising.¶
We have also encountered some very significant problems in trying to review the more than 1 million documents we recently received:¶
The data we’ve received has no way to put any emails and attachments together. So if an email says, “see the attached flight records,” for example, we have no way of linking that up with the records themselves. Not only is that a big problem for us in review, it’s going to be a huge problem for producing the documents to defense counsel.¶
- The load file has no link to the native file, so when we load the data to the database, there’s
Page 12 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00002005¶
EFTA00157187¶
no way to have the native files show up in the database. Because many of the files are too large to open in the viewer, it effectively means that there are many files that are completely invisible to us.¶
- Related, the control numbers in the load file don’t match up to the native files. So we have two sets of numbers and no way to match up anything—that is, even if we were to try to go hunt down every individual large file in the native files, it would be impossible.
So the data that we most recently got, we need to get in a form that addresses those issues, and we likely will need to get a similar reproduction of the data we received a couple months ago.¶
Otherwise we’re sifting through more than a million documents without much rhyme or reason.¶
I’ve re-attached the spreadsheet we sent last week – I think that’s a good place to start in terms of our necessary record-keeping, and we need that info at the very least, as well as anything else you think would be useful. Also attaching the SW returns for reference. And again, we’re happy to meet up anytime and hash all this out in person if that’s useful.¶
thanks,¶
Subject: RE: Epstein search warrant documents¶
Here is a listing of what I have already handed over in load files to the US Attorney’s Office for taint review. Some points of clarification: There were 9 IDE hard drives found in the Manhattan apartment, they turned out to be 3 copies of 3 drives (9 drives in total) from a July 2007 search on one of his properties. I only processed 3 (as they were all copies). All the loose media from the NY apartment is included. All the Windows machines from the NY apartment are included. Only 2 Macs from NY and 1 from the Island are included.¶
I will have to more closely coordinate with whoever is loading up Relativity with the remaining Macs as the tool they have to be processed with does not easily re-name the load files.¶
Spreadsheet is attached.¶
NYO CART Coordinator¶
Senior Forensic Examiner¶
3503-027¶
Page 13 of 17¶
SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7,8,9,10,15,and 17¶
EFTA_00002006¶