¶
Federal Bureau of Investigation Digital Evidence Laboratory¶
ERF Building 27958A Quentico. VA 22135¶
REPORT OF EXAMINATION¶
To: New York SA MIEM Request Date: Ref. No: Title: August 16, 2019 Serial 58 UNSUB(S); JEFFREY EPSTEIN - VICTIM; DEATH INVESTIGATION Date: June 16, 2021 Case ID: 090A-NY-3151227 Request No.: HQQ190816001¶
Date item(s) received: August 16, 2019¶
Item(s) submitted:¶
| HQQ019594: | DVR, Dell, PowerEdge R420, SBMQZ12, 1B20, One (1) DVR System Controller (Examined) | |||
|---|---|---|---|---|
| HQQ019333: | Hard Drive, Dell, WD5003ABYX-18WERAO, WMAYPODFPY4F, 1B20, One (1) hard disk drive from Bay 1 of DVR System Controller. (Examined) | |||
| HQQ019334: | Hard Drive. Dell, WD5003ABYX-18WERAO, WMAYPODNCDAV, 1B20, One (1) hard disk drive from Bay 2 of DVR System Controller. (Examined) | |||
| HQQ019595: | DVR, NICE Systems, SA-6640S, F96168201-004, 1B19, One (1) DVR Disk Army (DVR 2) (Examined) | |||
| HQQ019596: | DVR, NICE Systems, Nicevision PRO (NP-2000), 43144902, 1B19, One (1) DVR Disk Array Controller (DVR 2) (Examined) | |||
| HQQ01933I: | Hard Drive, Seagate, ST3320620AV, 9QFCN325, 1B19, One (1) hard disk | |||
| Page 1 of 9 | An Accredited Laboratory Since January 16, 2007 —888mmit-- |
UNCLASSIFIED¶
MIMIC RPM WILAWAT¶
| drive from top bay of DVR 2 Disk Array Controller. (Examined) | ||||
|---|---|---|---|---|
| HQQ019597: | DVR, NICE Systems, Premium 8600, 232476, 1B21, One (1) DVR Disk Array (DVR 1) (Examined) | |||
| HQQ018772: | Hard Drive, Western Digital, WD3200AAJB, WCAV21723809, From Bay 1 of HQQ019597 (Examined) | |||
| HQQ018773: | Hard Drive, Seagate, ST3320620AV, 9QF7PFHZ, From Bay 2 of HQQ019597 (Examined) | |||
| HQQ018774: | Hard Drive, Seagate, ST3320620AV, 9QF7P84L, Drive from Bay 3 of HQQ019597 (Examined) | |||
| HQQ018775: | Hard Drive, Seagate, ST3320620AV, 9QFCM8PR, From Bay 4 of HQQ0 19597 (Examined) | |||
| HQQ018776: | Hard Drive, Seagate, ST3320620AV, 9QF649J4, From Bay 5 of HQQ0 19597 (Examined) | |||
| HQQ018777: | Hard Drive, Seagate, ST3320620AV, 9QF7NJTG, From Bay 6 of HQQ0 19597 (Examined) | |||
| HQQ018778: | Hard Drive, Seagate, ST3320620AV, 9QFB0S6N, From Bay 7 of HQQ0 19597 (Examined) | |||
| HQQ018779: | Hard Drive, Seagate, ST3320620AV, 9QFB0P1Q, From Bay 8 of HQQ0 19597 (Examined) | |||
| HQQ018780: | Hard Drive, Seagate, ST3320620AV, 9QF7P8W1, From Bay 9 of HQQ0 19597 (Examined) | |||
| HQQ018781: | Hard Drive, Seagate, ST3320620AV, 9QF7PFPY, Bay 10 of HQQ0 19597 pcarnined) | |||
| HQQ018782: | Hard Drive, Seagate, ST3320620AV, 9QFCM7CS, From Bay 11 of HQQ019597 (Examined) | |||
| HQQ018783: | Hard Drive, Seagate, ST3320620AV, 9QF9Q0F5, From Bay 12 of HQQ0 19597 (Examined) | |||
| HQQ018784: | Hard Drive, Maxtor, MaXLine II, A830RYBE, Drive from Bay 13 (Examined) | |||
| HQQ018785: | Hard Drive, Western Digital, WD3200AAJB-00J3A0, WCAV21023754, From Bay 14 of HQQ019597 (Examined) | |||
| HQQ018786: | Hard Drive, Seagate, ST3320620AV, 9QFCJV3P, Bay 15 of HQQ0 19597 (Examined) | |||
| HQQ018787: | Hard Drive, Seagate, ST3320620AV, 9QF7N0SX, From Bay 16 of HQQ0 19597 (Examined) | |||
| HQQ019598: | DVR, NICE Systems, Nicevision PRO (NP-2000), 43144901, 1B21, One (1) | |||
| HQQ190816001 090A-NY-3 151227 | ||||
| Page 2 of 9 |
DVR Disk Array Controller (DVR 1) (Examined)¶
| HQQ018525: | Hard Drive, Maxtor, DiamondMax 10 (6L080P0), L25C8D3G, 1B21, One (1) hard disk drive from top bay of DVR 1 Disk Array Controller. (Examined) | |||
|---|---|---|---|---|
| HQQ018526: | Hard Drive, Maxtor, DiamondMax 10 (6L080P0), L25CF5QG, 1821, One (1) hard disk drive from bottom bay of DVR 1 Disk Array Controller. (Examined) | |||
| HQQ019599: | Hard Drive, Seagate, ST500DM002, Z3T6C.JJA, 1BI, One (1) hard drive (E6516194) (Examined) | |||
| HQQ019600: | Hard Drive, Hitachi, HDS721050CLA662, JP1572.1E36A13K, 182, One (I) hard drive (E6516195) (Examined) | |||
| HQQ019601: | Hard Drive, Seagate, ST500DM002, Z3T6CF5X, 183, One (1) hard drive (E6516196) (Examined) | |||
| HQQ019602: | Hard Drive, Seagate, ST3500320NS, 9QM8MT9P, 1134, One (1) hard drive (E6516197) (Examined) | |||
| HQQ019603: | Hard Drive, Hitachi, HDS721050CLA662, JP1572JE36MWNK, 1B5, One (1) hard drive (E6516198) (Examined) | |||
| HQQ019604: | Hard Drive, Seagate, ST3500320NS, 9QM8EC75, 1B6, One (1) hard drive (86516199) (Examined) | |||
| HQQ019605: | Hard Drive, Seagate, ST500NM0011, Z1M1PZPE, 1B7, One (1) hard drive (E6516200) (Examined) | |||
| HQQ019606: | Hard Drive, Western Digital, WD5000AVDS, WCAV9Z911026, 188, One (1) hard drive (E6516201) (Examined) | |||
| HQQ019607: | Hard Drive, Western Digital, WD5000AAKX, WCC2EJUC34CJ, 1B9, One (1) hard drive (86516202) (Examined) | |||
| HQQ019608: | Hard Drive, Seagate, ST3500320NS, 9QM8MSEZ, 1810, One (1) hard drive (E6516203) (Examined) | |||
| HQQ019609: | Hard Drive, Seagate, ST3500641A, 3PO00Q5E, Partial image of DVR 2 system drive (Examined) | |||
| HQQ019610: | CD-R, Photos of bad drives. (Examined). | |||
| HQQ01961I: | Hard Drive, Seagate, ST500NM0011, Z1M1PX26, 1811, One (1) hard drive (E6516204) (Examined) | |||
| HQQ019612: | Hard Drive, Seagate, ST500NM0011, ZIMIQIFX, 1812, One (1) hard drive (E6516205) (Examined) | |||
| HQQ019613: | Hard Drive, Western Digital, WD5000AVDS, WCAV9T870016, 1813, One (1) hard drive (86516206) (Examined) | |||
| HQQ190816001 090A-NY-3151227 | ||||
Page 3 of 9¶
| HQQ019614: | Hard Drive, Western Digital, WD5000AAKX, WCC2E0DE83YK, 1B14, One (1) hard drive (E6516207) (Examined) | |||
|---|---|---|---|---|
| HQQ0I9615: | Hard Drive, Seagate, ST3500320NS, 9QM8MT6D, 1B15, One (1) hard drive (E6516208) (Examined) | |||
| 11QQ019616: | Hard Drive, Seagate, ST500NM0011, Z1M1PZ07, 1B16, One (1) hard drive (E6516209) (Examined) | |||
| HQQ019617: | Hard Drive, Seagate, ST500NM0011, Z1M1L0YG, 1B17, One (1) hard drive (E6516210) (Examined) | |||
| HQQ019618: | Hard Drive, Seagate, ST3500320NS, 9QM8MSRR, 1B18, One (1) hard drive (E6516211) (Examined) | |||
| HQQ019619: | Hard Drive, Seagate, ST1000DM003, S1D85PLA, 1B22, Clone of 1B1 (E6515200) (Examined) | |||
| HQQ019620: | Hard Drive, Hitachi, HUA722010CLA330, N039F71T 1B23, Clone of IB2 (E6515201) (Examined) | |||
| HQQ019621: | Hard Drive, Seagate, ST1000DM003, Z1D3ZSS0, IB24, Clone of 1B3 (E6515202) (Examined) | |||
| HQQ019622: | Hard Drive, Seagate, ST1000DM003, Z4YDJL1T, 1B25, Clone of 1B4 (E6515203) (Examined) | |||
| HQQ019623: | Hard Drive, Seagate, ST1000DM003, Z4YDHX5M, 1B26, Clone of 1B6 (E6515204) (Examined) | |||
| HQQ019624: | Hard Drive, Seagate, ST1000DM003, W1D48YH6, 1B27, Clone of 1B7 (E6515205) (Examined) | |||
| HQQ019625: | Hard Drive, Western Digital, WD10EADS, WCAU45803950, 1B28, Clone of 1B8 (E6515206) (Examined) | |||
| HQQ019626: | Hard Drive, Seagate, STI000DM003, Z4Y00Q48, 1B29, Clone of 1B9 (E6515207) (Examined) | |||
| HQQ019627: | Hard Drive, Seagate, ST1000DM003, W1D496N0, 1B30, Clone of 1B10 (E6516228) (Examined) | |||
| HQQ019628: | Hard Drive, Seagate, STI000DM003, Z1DB25CT, 1B31, Clone of 1B11 (E6516229) (Examined) | |||
| HQQ019629: | Hard Drive, Seagate, ST1000DM003, W1D48Z6E, 1B32, Clone of 1B12 (E6516230) (Examined) | |||
| HQQ019630: | Hard Drive, Western Digital, WD1003FZEX, WCC3F2783519, IB33, Clone of IBIS (E651623 I) (Examined) | |||
| HQQ019631: | Hard Drive, Seagate, ST1000DM003, S1D9GK9P, 1B34, Clone of 1B16 | |||
| HQQ190816001 090A-NY-3 151227 | ||||
| Page 4 of 9 | ||||
| UNCLASSIFIED |
EFTA00127407¶
UNCLASSIFIED (E6516232) (Examined) HQQ019632: Hard Drive, Seagate, ST1000DM003, S1D9DETC, (E6516233) (Examined) HQQ019633: Hard Drive, Seagate, STI000DM003, W1D06T5L, (E6516234) (Examined) 1B35, Clone of 1B17 1B36, Clone of 1B18¶
Summary:¶
Per Electronic Communication (EC) dated 8/26/2019, Special Agent (SA) a¶
transferred the submitted specimens from the New York field office to the Operational Technology Division/Digital Forensics Analysis Unit (OTD/DFAU) in Quantico for examination. The specimens were received by the Computer Analysis Response Team (CART) for analysis.¶
Per discussion with CART Laboratory Supervisor MM on 8/19/2019, the Digital Video Recorder (DVR) system is to be assembled to allow export of videos contained on the system.¶
The DVR system consisted of a main controller and 2 disk arrays, labeled as DVR 1 and DVR 2.¶
DVR 1 was assembled successfully and made available for export of videos. Video Specialist performed exports based on requests made by the NY investigative team. On 12/19/2019, DVR 1 failed due to hardware issues. Contact with the vendor and attempts to use replacement parts were unsuccessful in restoring the disk array to a usable state.¶
DVR 2 contained 3 hard disk drives that were repaired by Advanced Data Recovery Specialist However, DVR 2 was never able to be assembled successfully. A review of the logs on the DVR 2 controller indicated catastrophic disk failures before receipt by the FBI.¶
A master copy of the images of the hard disk drives contained in the DVR system were placed on to 3 hard drives for storage (labeled as HQQ026637-HQQ026639).¶
Details of Examination:¶
The dates of this examination were August 20, 2019 through May 24, 2021.¶
HQQ190816001 090A-NY-3151227¶
Page 5 of 9¶
| 1B# | AQQ# | Item | Contents |
|---|---|---|---|
| 1820 | ' HQQ019594 | in Controller | Contained 2 drives |
| 11321 (2 of 2) | HQQ019598 | DVR 1 Controller | Contained 2 drives |
| 1821 (1 of 2) | HQQ019597 | DVR 1 Disk Array | Contained 16 drives |
| 1819 (2 oft) | HQQ019596 | DVR 2 Controller | Contained 1 drive |
| 1819 (1 oft) | HQQ019595 | IDVR 2 Disk Array | Array is empty |
The submitted items were parts of a DVR system, overview as follows:¶
The hard disk drives contained in the units were write blocked and forensic images created as follows:¶
Main Controller - Forensic images of the 2 drives were created to a forensically clean network share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by FE EIMI¶
DVR 1 Controller - The top bay drive was repaired by Recovery Specialist i. Forensic images of the 2 drives were created to a forensically clean network share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by FE¶
DVR 1 Disk Array - Forensic images of the 16 drives were created to a forensically clean network share in Quantico for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by FE¶
DVR 2 Controller - Forensic image of the 1 drive was created to a forensically clean network share in Quantico for archive. A forensic copy of the drive (clone) was also created on an additional physical drive to be used in the unit for assembly. These actions were performed by FE a¶
DVR 2 Disk Array - The 16 drives originally contained in the unit were provided to the NY FO. Forensic images of the 16 drives were created to a forensically clean network share in New York for archive. Forensic copies of the drives (clones) were also created on additional physical drives to be used in the unit for assembly. These actions were performed by NY FE's and provided to the CART team in Quantico.¶
The DVR system was assembled using the clones and powered on.¶
The Main Controller started up successfully and was accessed using Administrator password "!Nicelog" as provided by the vendor. The NICE suite of software, which provides visibility into the¶
| HQQ190816001 |
|---|
| 090A-NY-3151227 |
Page 6 of 9¶
setup and recordings on DVR 1 and DVR 2 was accessed using password "NICE" to gain access to the administrator functions. A review indicated that roughly half of the camera assignments were allotted to each DVR.¶
DVR 1 started up successfully and recordings were available for export through the Main Controller software interface. DVR 2 did not start successfully.¶
On 9/18/2019, a meeting was conducted with DVR vendor Technical Support Representative la of SigNet Technologies. rovided an overview of the o eration of the system. A review of the DVR 2 controller logs by and Senior Advisor 1 indicated that there had been cat trophic disk failures in the arra and no recordings would have been available after 7/29/2019. and Computer Scientist were provided access to the beginning sectors of e 16 rives to see if the structure would indicate clues of a possible rebuild. None were apparent.¶
Video Specialist was provided access to the DVR software and performed exports of the available recordings on DVR 1 based on investigative team requests.¶
On 12/19/2019, Video Specialist reported beeping from the disk array and inability to use the software to continue to perform exports. A review of the unit indicated memory errors. Attempts at reseating memory board and RAM were unsuccessful. The vendor was contacted for replacement parts, but none were available due to the age of the unit. Lab Supervisor Mg purchased and provided exemplar memory board and RAM. Several attempts to restore the unit to working order with replacement parts were unsuccessful and eventually exhausted.¶
The DVR system original items and clones were returned to NY FO. Master copies of the Main Controller, DVR 1 images, DVR 2 repaired drive images, and video exports were placed on to hard disk drives (HQQ026637-HQQ026639) for storage. NY CART Examiners will perform archive of the DVR 2 images located on the NY FO network share.¶
Derivative Evidence/Copies:¶
| HQQ018788: | Hard Drive, Western Digital, WD3200AAJB, WCARW3862711, Clone of HQQO 18772 Bay 1 |
|---|---|
| HQQ018789: | Hard Drive, Western Digital, WD3200AAJB, WCARW4061457, Clone of HQQ018773 Bay 2 |
| HQQ018790: | Hard Drive, Western Digital, WD3200AAJB, WCARW4061578, Clone of HQQO 18774 Bay 3 |
| HQQ018791: | Hard Drive, Western Digital, WD3200AAJB, WCARW3816411, Clone of HQQ018775 Bay 4 |
| HQQ018792: | Hard Drive, Western Digital, WD3200AAJB, WCARW3886572, Clone of |
| HQQ 190816001 090A-NY-3 151227 | |
| Page 7 of 9 | |
| UNCLASSIFIED | |
HQQ018776 Bay 5¶
| HQQ018793: | Hard Drive, Western Digital, WD3200AAJB, WCARW3914931, Clone of HQQO 18777 Bay 6 |
|---|---|
| HQQ018794: | I-Iard Drive, Western Digital, WD3200AAJB, WCARW3809038, Clone of HQQ0I8778 Bay 7 |
| HQQ018795: | Hard Drive, Western Digital, WD3200AAJB, WCARW4064417, Clone of HQQ0I8779 Bay 8 |
| HQQ018796: | Hard Drive, Western Digital, WD3200AAJB, WCARW3816301, Clone of HQQ018780 Bay 9 |
| HQQ018797: | Hard Drive, Western Digital, WD3200AAJB, WCARW3915042, Clone of HQQ018781 Bay 10 |
| HQQ018798: | Hard Drive, Western Digital, WD3200AAJB, WCARW3809320, Clone of HQQ018782 Bay 11 |
| HQQ018799: | Hard Drive, Western Digital, WD3200AAJB, WCARW3816426, Clone of HQQO 18783 Bay 12 |
| HQQ018800: | Hard Drive, Western Digital, WD3200AAJB, WCARW3809296, Clone of HQQ018784 from Bay 13 of IIQQ019597 |
| HQQ01880I: | Hard Drive, Western Digital, WD3200AAJB, WCARW3809224, Clone of HQQ018785 Bay 14 |
| HQQ018802: | Hard Drive, Western Digital, WD3200AAJB, WCARW3755653, Clone of HQQ018786 Bay 15 |
| HQQ018803: | Hard Drive, Western Digital, WD3200AAJB, WCARW3816498, Clone of HQQ018787 Bay 16 |
| HQQ019332: | Hard Drive, Seagate, ST3500630A, 9QG23RDP, Clone of HQQ019331 (top bay of DVR2 Disk Array Controller) |
| HQQ019335: | Hard Drive, Western Digital, WD1001FALS-41Y6A1, WCATR7962678, Clone of HQQO 19333 (Bay 1 of Main Controller) |
| HQQ019336: | Hard Drive, Western Digital, WD15EVDS-73V9B1, WMAVU4005952, Clone of HQQ019334 (Bay 2 of Main Controller) |
| HQQ019337: | Hard Drive, Maxtor, DiamondMax 6L300R0, L60YGFBG, Clone of HQQ018526 |
| HQQ019353: | Hard Drive, Maxtor, 6L200PD, L41RWHTH, Clone of repaired HQQO 18525 |
| HQQ019354: | Hard Drive, Seagate, ST3500630AS, 9QG4FNAD, Clone of repaired 1B17 |
| HQQ019355: | Hard Drive, Toshiba, dt01aca050, 74J2Z3GAS, Clone of repaired 1B18 |
| HQQ1908 16001 | |
| 090A-NY-3 151227 | |
| Page 8 of 9 | |
| UNCLASSIFIED |
EFTA00127411¶
| HQQ019356: | Hard Drive, Seagate, ST3500410SV, 6VM5VRFN, Clone of repaired 1B14 |
|---|---|
| HQQ019361: | Hard Drive, Seagate, ST5OONM0011, ZIM16CCO, Clone of repaired 1B13 |
| HQQ019363: | Hard Drive, Seagate. ST5OONM0011, Z1M16CMQ, Clone of repaired 185 |
| HQQ026637: | Hard Drive. Western Digital. WD20EARS-22MVWBO, WCAZA6894206, Contains Master Copy of DVR Main Controller images. |
| HQQ026638: | Hard Drive, Seagate, ST100000VN0008, ZPWOICE1R, Contains Master Copy of DVR 1 images. |
| HQQ026639: | Hard Drive. Western Digital, WD4003FZEX-00Z4SAO, WMC5DOD9K9RO, Contains Master Copy of DVR 2 controller, DVR 2 repaired drive images, and Video Exports. |
Disposition of Items:¶
All original evidence items and derivative evidence items including Master Copies (HQQ026637- HQQ026639) were submitted to O1T) Evidence Control for delivery to the contributing office. No electronic evidence is being retained at DFAU Headquarters. The notes of this examination are being placed in a Digital Evidence Laboratory (DEL) file jacket and being retained in the FBI O11) file.¶
Examiner.¶
¶
Computer Analysis Response Team Program¶
HQQI90816001 090A-NY-3 151227¶
Page 9 of 9¶