# UNCLASSIFIED//FOUO

Operational Technology Division
Countering Threats Through Technology

## (U//FOUO) UNSUB; JEFFREY EPSTEIN – VICTIM; DEATH INVESTIGATION Digital Evidence Tracking

[Image] Executive Summary: The New York Division (NY) initiated a death investigation for the apparent suicide of Jeffrey EPSTEIN at the Metropolitan Correctional Center (MCC) which occurred on 10 August 2019. On 12 August 2019, OTD was contacted by the NY Division for assistance with a MCC video surveillance system consisting of two Digital Video Recorders (DVR1 - operational and DVR2 – not operational) and a controller. The NY Division Computer Analysis Response Team (NY CART) has collected digital evidence items associated with this investigation. OTD is currently tracking 37 digital evidence items (associated with DVR1 and DVR2):

<table border="1"><tr><td colspan="6">(U//FOUO)90A-NY-3151227 Digital Evidence items-As of 21 August 2019 1400</td></tr><tr><td>Description</td><td>Physical Location</td><td>Status</td><td>Challenges</td><td>Lawful Access</td><td>Time in Process</td></tr><tr><td>1B1-Hard Drive-Seagate Barracuda500GB HDD,ST500DM002,S/NZ3T6CJJA(DVR2-1of18)NYC023578</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence control pending shipment to OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr><tr><td>1B2-Hard Drive-Hitachi500GB HDD,HDS721050CLA662,S/NJP1572JE36A13K(DVR2-2of18)NYC023579</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence control pending shipment to OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr></table>

UNCLASSIFIED//FOUO

EFTA00174637



# UNCLASSIFIED//FOUO

Operational Technology Division

Countering Threats Through Technology



<table border="1"><tr><td colspan="6">(U//FOUO) 90A-NY-3151227 Digital Evidence items – As of 21 August 2019 1400</td></tr><tr><td>Description</td><td>Physical Location</td><td>Status</td><td>Challenges</td><td>Lawful Access</td><td>Time in Process</td></tr><tr><td>1B3-Hard Drive-Seagate Barracuda500GB HDD,ST500DM002,S/NZ3T6CF5X(DVR2-3of18)NYC023580</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence controlpending shipment to OTD.</td><td>N/A</td><td>N/A</td><td>Started:8/16/2019</td></tr><tr><td>1B4-Hard Drive-Seagate Barracuda500GB HDD,ST3500320NS,S/N9QM8MT9P(DVR24of18)NYC023581</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence controlpending shipment to OTD.</td><td>N/A</td><td>N/A</td><td>Started:8/16/2019</td></tr><tr><td>1B5-Hard Drive-Hitachi500GB HDD,HDS721050CLA662,S/N:JP1572JE36MWNK(DVR2-5of18)NYC023582</td><td>OTD-DFAU</td><td>8/21/2019-Repaired,data is being recovered-26% complete.8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.Pending delivery of donor parts for repair.8/15/2019-Collected,in evidence controlpending shipment to OTD.</td><td>Damaged</td><td>N/A</td><td>Started:8/16/2019</td></tr></table>

UNCLASSIFIED//FOUO

EFTA00174638



# UNCLASSIFIED//FOUO

Operational Technology Division

Countering Threats Through Technology



<table border="1"><tr><td colspan="6">(U//FOUO)90A-NY-3151227 Digital Evidence items – As of 21 August 2019 1400</td></tr><tr><td>Description</td><td>Physical Location</td><td>Status</td><td>Challenges</td><td>Lawful Access</td><td>Time in Process</td></tr><tr><td>1B6-Hard Drive-Seagate Barracuda500GB HDD,ST3500320NS,S/N9QM8EC75(DVR2-6of18)NYC023583</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence control pending shipment to OTD.</td><td>N/A</td><td>N/A</td><td>Started:8/16/2019</td></tr><tr><td>1B7-Hard Drive-Seagate ConstellationES500GB HDD,ST500NM0011,S/NZ1M1PZPE(DVR2-7of18)NYC023584</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence control pending shipment to OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr><tr><td>1B8-Hard Drive-Western Digital500GB HDD,WD5000AVDS-63U7B1,S/NWCAV9Z911026(DVR2-8of18)NYC023585</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence control pending shipment to OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr></table>

UNCLASSIFIED//FOUO

EFTA00174639



# UNCLASSIFIED//FOUO

Operational Technology Division

Countering Threats Through Technology



<table border="1"><tr><td colspan="6">(U//FOUO)90A-NY-3151227 Digital Evidence items – As of 21 August 2019 1400</td></tr><tr><td>Description</td><td>Physical Location</td><td>Status</td><td>Challenges</td><td>Lawful Access</td><td>Time in Process</td></tr><tr><td>1B9-Hard Drive-Western Digital500GB HDD,WD5000AAKX-60U6AA0,S/NWCC2EJUC34CJ(DVR2-9 of 18)NYC023586</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence control pending shipment to OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr><tr><td>1B10-Hard Drive-Seagate Barracuda500GB HDD,ST3500320N5,S/N9QM8MSEZ(DVR2-10 of 18)NYC023587</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence control pending shipment to OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr><tr><td>1B11-Hard Drive-Seagate ConstellationES500GB HDD,ST500NM0011,S/NZ1M1PX26(DVR2-11 of 18)NYC023588</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence control pending shipment to OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr><tr><td>1B12-Hard Drive-Seagate ConstellationES500GB HDD,ST500NM0011,S/NZ1M1Q1FX(DVR2-12 of 18)NYC023589</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.DataRecovery Program assessment ongoing.8/15/2019-Collected,in evidence control pending shipment to OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr></table>

UNCLASSIFIED//FOUO

EFTA00174640



# UNCLASSIFIED//FOUO

Operational Technology Division

Countering Threats Through Technology



<table><thead><tr><th colspan="6">(U//FOUO) 90A-NY-3151227 Digital Evidence items – As of 21 August 2019 1400</th></tr><tr><th>Description</th><th>Physical Location</th><th>Status</th><th>Challenges</th><th>Lawful Access</th><th>Time in Process</th></tr></thead><tbody><tr><td rowspan="3">1B13 – Hard Drive - Western Digital 500GB HDD, WD5000AVDS-63U7B1, S/N WCAV9T870016 (DVR2 – 13 of 18) NYC023590</td><td rowspan="3">OTD - DFAU</td><td>8/19/2019 – Damaged heads. DFAU performed head stack swap, data is slowly imaging. 97% complete.</td><td rowspan="3">Damaged</td><td rowspan="3">TBD</td><td rowspan="3">Started: 8/16/2019</td></tr><tr><td>8/16/2019 – Device arrived at OTD. Data Recovery Program assessment ongoing.</td></tr><tr><td>8/15/2019 - Collected, in evidence control pending shipment to OTD.</td></tr><tr><td rowspan="3">1B14 – Hard Drive - Western Digital 500GB HDD, WD5000AAKX-60U6AA0, S/N WCC2E0DE83YK (DVR2 – 14 of 18) NYC023591</td><td rowspan="3">OTD - DFAU</td><td>8/21/2019 – Repairs underway, data is being recovered.</td><td rowspan="3">Damaged</td><td rowspan="3">TBD</td><td rowspan="3">Started: 8/16/2019</td></tr><tr><td>8/16/2019 – Device arrived at OTD. Data Recovery Program assessment ongoing. Pending delivery of donor parts for repair.</td></tr><tr><td>8/15/2019 - Collected, in evidence control pending shipment to OTD.</td></tr><tr><td rowspan="2">1B15 – Hard Drive - Seagate Barracuda 500GB HDD, ST3500320N5, S/N 9QM8MT6D (DVR2 – 15 of 18) NYC023592</td><td rowspan="2">OTD - DFAU</td><td>8/16/2019 – Device arrived at OTD. Data Recovery Program assessment ongoing.</td><td rowspan="2">TBD</td><td rowspan="2">TBD</td><td rowspan="2">Started: 8/16/2019</td></tr><tr><td>8/15/2019 - Collected, in evidence control pending shipment to OTD.</td></tr></tbody></table>

UNCLASSIFIED//FOUO

EFTA00174641



# UNCLASSIFIED//FOUO

Operational Technology Division

Countering Threats Through Technology



<table border="1"><tr><td colspan="6">(U//FOUO) 90A-NY-3151227 Digital Evidence items – As of 21 August 2019 1400</td></tr><tr><td>Description</td><td>Physical Location</td><td>Status</td><td>Challenges</td><td>Lawful Access</td><td>Time in Process</td></tr><tr><td>1B16 - Hard Drive - Seagate Constellation ES 500GB HDD, ST500NM0011, S/N Z1M1PZ07(DVR2-16 of 18)NYC023593</td><td>OTD-DFAU</td><td>8/16/2019-Device arrived at OTD.Data Recovery Program assessment ongoing.
8/15/2019-Collected, in evidence control pending shipment to OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr><tr><td>1B17 - Hard Drive - Seagate Constellation ES 500GB HDD, ST500NM0011,S/N Z1M1L0VG(DVR2-17 of 18)NYC023594</td><td>OTD-DFAU</td><td>8/19/2019-DFAU reports 100% data recovery, device is currently imaging.
8/16/2019-Device arrived at OTD.Data Recovery Program assessment ongoing.
8/15/2019-Collected, in evidence control pending shipment to OTD.</td><td>Damaged</td><td>TBD</td><td>Started:8/16/2019</td></tr><tr><td>1B18 - Hard Drive - Seagate Barracuda 500GB HDD,ST3500320NS,S/N 9QM8MSRR(DVR2-18 of 18)NYC023595</td><td>OTD-DFAU</td><td>8/19/2019-DFAU reports partial data recovery(44 bad sectors not recovered),device is imaging.
8/16/2019-Device arrived at OTD.Data Recovery Program assessment ongoing.
8/15/2019-Collected, in evidence control pending shipment to OTD.</td><td>Damaged</td><td>TBD</td><td>Started:8/16/2019</td></tr></table>

UNCLASSIFIED//FOUO

EFTA00174642



# UNCLASSIFIED//FOUO

Operational Technology Division

Countering Threats Through Technology



<table border="1"><tr><td colspan="6">(U//FOUO)90A-NY-3151227 Digital Evidence items-As of 21 August 2019 1400</td></tr><tr><td>Description</td><td>Physical Location</td><td>Status</td><td>Challenges</td><td>Lawful Access</td><td>Time in Process</td></tr><tr><td>1B19-Disk Array Chassis; Model#:SA-6640S,SN:F96168201-004 and Disk Array Controller;Model#:NP-2000,SN:43144902(DVR2)</td><td>OTD-DFAU</td><td>8/16/2019-Chassis and controller for inoperable DVR2 arrived at OTD.Data Recovery Program assessment ongoing.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr><tr><td>1B20-DVR Controller-Dell PowerEdge R420 DVR Controller,Barcode#5BMQZ12,Express service Code #:11587249622,Manufacturer date:20140829(DVR1)</td><td>OTD-DFAU</td><td>8/16/2019-DVR controller for operable DVR1 arrived at OTD.Data Recovery Program assessment ongoing.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr><tr><td>1B21-DVR System-Disk Array Chassis containing16 hard Drives;Model#:Premium8600,SN:232476 and Disk Array Controller;Model#:NP-2000,SN:43144901(DVR1)</td><td>OTD-DFAU</td><td>8/16/2019-Operable DVR1 system arrived at OTD.</td><td>TBD</td><td>TBD</td><td>Started:8/16/2019</td></tr></table>

UNCLASSIFIED//FOUO

EFTA00174643



# UNCLASSIFIED//FOUO

Operational Technology Division

Countering Threats Through Technology



<table border="1"><tr><td colspan="6">(U//FOUO) 90A-NY-3151227 Digital Evidence items – As of 21 August 2019 1400</td></tr><tr><td>Description</td><td>Physical Location</td><td>Status</td><td>Challenges</td><td>Lawful Access</td><td>Time in Process</td></tr><tr><td>1B22-1B36-Derivative Evidence-14 Hard Drives containing clone copies of multiple Hard Drives from DVR2.</td><td>OTD-DFAU</td><td>8/21/2019-Arrived at QT on 8/20,in process with DFAU.
8/19/2019-Derivative evidence-clone copies of hard drives removed from DVR2.Collected by DFAU UC Petronella to be delivered to OTD on 8/20/2019</td><td>N/A</td><td>N/A</td><td>TBD</td></tr><tr><td>1B40-Hard Drive-One(1) Seagate 500GB hard drive, serial number W2AEXSJV,containing video downloaded from DVR1 at MCC</td><td>NY CART</td><td>8/19/2019-Copy of all video available for download for 8/10/2019,All relevant video from Special Housing Unit floor 9 and Attorney Visit area floor 3 from 7/23 to 8/10/2019,All video available to download for 8/9(THIS DOWNLOAD FAILED)and video downloaded by tech,(that is the wrong camera).</td><td>N/A</td><td>N/A</td><td>N/A</td></tr><tr><td>No1B-Hard drive containing video footage,HQQ018525</td><td>OTD-DFAU</td><td>8/21/2019-Damaged hard drive repaired,data is being recovered(10 bad sectors).</td><td>Damaged</td><td>N/A</td><td>Started:8/19/2019</td></tr></table>

UNCLASSIFIED//FOUO

EFTA00174644