All Details Case Details Contact Details Case Assets Case Collection Evidence Details Case Photographs Case Disposal le Forensic Hardware and Sofware 0384 Report Produced : 12/04/2019 11:57:52 Produced By : Ft las Forensic Hardware and Sofware 0384 Report Produced : 12/04/2019 11:57:52 Produced By : Case Details Case Reference 0384 IDMS Reference 2019-010614 Examiner FY Case Service Level PRIORITY Analysis Type Job Performance Failure Case Classification Level UNCLASSIFIED Service Level 7 Days Open Date/Time 08/13/2019 08:10:46 (-0400) Due Date/Time 08/20/2019 23:59:59 (-0400) Case Status Open Contact Name || FY Assigned Staff Member Name Ft Record Status Unlocked 2 Desktop Computers submitted on 8/13/19; Case Background 2 additional desktop computers submitting on 8/21/19. Background Attachment(s) 2019-010614 Request Form.pdf Leonard Notes.docx Technical Review Technical Review Yes Appropriate examinations have been performed to address request Yes Report is clear and understandable Yes The procedures performed were adequately documented and Yes forensically sound Exam documentation was sufficiently detailed to enable reproduction Yes of the results EFTA00128367

--=PAGE_BREAK=--

The interpretations and conclusions of the examiner were reasonable Report is consistent with the examination documentation When generally accepted examination tools are not used, are significant findings verified by the examiner? Results media has been spot checked Examiner performing review Date of review Contact Details First Name || Last Name FY] Sector New York Field Office Primary Email _ Authority Contact Name Fs Authority Contact Number 7034131860 Authority Contact Email [gE Authority Status Approved Case Assets Product Name Tableau TD2 Asset Tag X29946 Case Process Evidence Imaging - Write Blocker (0002) Tracked Asset Yes Asset Type — Hardware Product Name Tableau TD2 Asset Tag X29946 Case Process Evidence Imaging - Write Blocker (0004) Tracked Asset Yes Asset Type — Hardware Product Name Alienware Asset Tag X29717 Case Process Unknown Tracked Asset Yes Asset Type — Hardware Product Name Aegis Fortress Asset Tag 101300010379 Case Process Unknown Tracked Asset Yes Asset Type — Hardware Case Collection Collection Date/Time 08/11/2019 11:28:00 (-0400) Collection From FY Collection Type Collection Method Staff Collection ITS Canabal 09/11/2019 EFTA00128368

--=PAGE_BREAK=--

Evidence Status Complete Assigned Staff Member Name Office Cyber Investigations Office New York Company US Department of Justice Office of the Inspector General CompanyAddress 1401 S Clark St. Suite 900 Arlington VA 22202 United States Company Contact Name Cyber Investigations Washington Company Contact Number [ Collected Exhibits Evidence Reference 0001 Evidence Type Desktop Seal Number N/A Description HP EliteDesk 800 S/N: 2UA4381LYNJ Evidence Reference 0002 Evidence Type Hard Drive Seal Number N/A Description Seagate 500 GB SATA HDD S/N: Z6E8M349 Evidence Reference 0003 Evidence Type Desktop Seal Number N/A Description HP EliteDesk 800 S/N: 2UA4381YMW Evidence Reference 0004 Evidence Type Hard Drive Seal Number N/A Description Seagate 500 GB SATA HDD S/N: Z6E8KIEV Attachment(s) ECD In.pdf Collection Date/Time 08/21/2019 00:00:00 (-0400) Collection From || | Collection Type Collection Method Staff Collection Evidence Status Complete Assigned Staff Member Name [I Office New York Field Office Company US Department of Justice Office of the Inspector General CompanyAddress 1 Battery Park Plaza 29th Floor New York New York 10004 United States EFTA00128369

--=PAGE_BREAK=--

Company Contact Name New York Field Office Collected Exhibits Evidence Reference Evidence Type Seal Number Description Evidence Reference Evidence Type Seal Number Description Evidence Reference Evidence Type Seal Number Description Evidence Reference Evidence Type Seal Number Description Attachment(s) Evidence Details Evidence Reference Evidence Type 0005 Desktop N/A HP EliteDesk 800 S/N: 2UA4381LXJW 0006 Hard Drive N/A Seagate 500GB SATA HDD S/N: Z6E8KD3N 0007 Desktop N/A HP Compaq 8200 Elite 0008 Hard Drive N/A Hitachi 500GB SATA HDD S/N: JP1572JE36LSNK ECD in.pdf 0001 Desktop Logged In Date/Time 08/11/2019 04:15:35 (-0400) Original Seal Number N/A Storage Location Priority Description Property Number Seized Date/Time Washington Vault High HP EliteDesk 800 S/N: 2UA4381YNJ 0214 207268 08/11/2019 11:00:34 (-0400) Seized By/Produced By Processing Result Archived Pre-Imaging Details Start Date/Time N/A No 08/14/2019 19:15:45 (-0400) End Date/Time 08/14/2019 19:25:00 (-0400) Conducted By (Name) Manufacturer Hewlett Packard Model EliteDesk 800 Serial Number 2UA381YNJ Casing Type Workstation Casing Colour Black BIOS Key F10 BIOS Date/Time 08/14/2019 19:21 EFTA00128370

--=PAGE_BREAK=--

Actual Date/Time 08/14/2019 19:21 Password Protected No Attachment(s) IMG _0075.JPG Evidence Reference 0002 Evidence Type Hard Drive Logged In Date/Time 08/11/2019 04:15:35 (-0400) Original Seal Number N/A Storage Location Washington Vault Priority High Description Seagate 500 GB SATA HDD S/N: Z6E8M349 Property Number N/A Seized Date/Time 08/11/2019 11:00:30 (-0400) Seized By/Produced By EE Processing Result N/A Archived No Attachment(s) Hash Match. jpg Pre-Imaging Details Start Date/Time 08/11/2019 16:00:00(-0400) Conducted By (Name) | Manufacturer Seagate Model STS00DM002 Serial Number Z6E8M349 Type SATA HDD Notes Drive removed from desktop 0214 207268 for imaging by Lidsky on 8/11/19 at CC lab. Attachment(s) Imaging Details Start Date/Time End Date/Time 08/11/2019 16:40:28 (-0400) 08/11/2019 18:14:00 (-0400) Conducted By (Name) | Software Used Write Blocker Image Type Compression Block Size Cyclic Redundancy Check (CRC) MDS SHAI Image Verified Imaging Workstation Notes Tableau Tableau TD2 (X29946) E01 None 64 64 13e7ad6132719bae78d849e3 {9 1 4cec2 465c7bf5 f62aebb6c98ecfc60534110f56274c25 No N/A Imaging cancelled by Lidsky prior to verification completion. Subsequent hash match confirmed (see info under evidence details). Imaging started: 2019-08-11 16:43 Imaging finished: 2019-08-11 18:14 EFTA00128371

--=PAGE_BREAK=--

Attachment(s) Evidence Reference Evidence Type Logged In Date/Time Original Seal Number Storage Location Priority Description Property Number Seized Date/Time Tableau device serial number: 11d2003b Tableau firmware revision: 4.01 Tableau firmware timestamp: May 02 2013 21:35:47 Source device model: STSO00DM002-1BD142 Source device serial number: Z6E8M349 Source device HPA in use: No Source device DCO in use: No Source device capacity reported Pwr-ON: 976,773,168 (500.1 GB) Source device capacity reported by HPA: 976,773,168 (500.1 GB) Source device capacity reported by DCO: 976,773,168 (500.1 GB) 2019-08-11 16-43-11 00107 D2F.LOG 0003 Desktop 08/13/2019 09:00:35 (-0400) N/A Washington Vault High HP EliteDesk 800 S/N: 2UA4381YMW 0214 207270 08/11/2019 11:00:03 (-0400) Seized By/Produced By Processing Result Archived Pre-Imaging Details Start Date/Time N/A No 08/14/2019 19:00:00 (-0400) End Date/Time 08/14/2019 19:25:00 (-0400) Conducted By (Name) | Manufacturer Hewlett Packard Model EliteDesk 800 Serial Number 2UA4381YMW Casing Type Workstation Casing Colour Black BIOS Key F10 BIOS Date/Time Actual Date/Time Password Protected Attachment(s) Evidence Reference Evidence Type Logged In Date/Time Original Seal Number Storage Location Priority Description 08/14/2019 19:18 08/14/2019 19:18 No IMG _0073.JPG 0004 Hard Drive 08/13/2019 09:00:35 (-0400) N/A Washington Vault High Seagate 500 GB SATA HDD S/N: Z6E8KIEV EFTA00128372

--=PAGE_BREAK=--

Property Number Seized Date/Time 08/11/2019 11:00:01 (-0400) Seized By/Produced By EE Processing Result Archived Pre-Imaging Details Start Date/Time 08/11/2019 16:00:00(-0400) Conducted By (Name) | Manufacturer Seagate Model STS00DM002 Serial Number Z6E8KIEV Type SATA HDD Notes Drive removed from desktop 0214 207270 for imaging by Lidsky on 8/11/19 at CC lab. Attachment(s) Imaging Details Start Date/Time End Date/Time Conducted By (Name) Software Used Write Blocker Image Type Compression Block Size 08/11/2019 18:17:11 (-0400) 08/11/2019 21:16:00 (-0400) ma Tableau Tableau TD2 (X29946) E01 None 64 Cyclic Redundancy Check (CRC) 64 MD5 SHAI Image Verified Imaging Workstation Notes Attachment(s) Case Photographs 0001: IMG_0046.JPG (923893_IMG_0046.JPG 48f956e5ddab702d48 177534ec96d026 be979 | bce5978ccdf3 11 1aS54eac84606739c0424 No N/A Imaging started: 2019-08-11 18:17 Imaging finished: 2019-08-11 21:16 Tableau device serial number: 11d2003b Tableau firmware revision: 4.01 Tableau firmware timestamp: May 02 2013 21:35:47 Source device model: STS00DM002-1BD142 Source device serial number: Z6E8K1EV Source device HPA in use: No Source device DCO in use: No Source device capacity reported Pwr-ON: 976,773,168 (500.1 GB) Source device capacity reported by HPA: 976,773,168 (500.1 GB) Source device capacity reported by DCO: 976,773,168 (500.1 GB) 2019-08-11 18-17-23 00108 D2F.LOG EFTA00128373

--=PAGE_BREAK=--

0001: IMG_0047.JPG (613894. IMG_0047.JPG 0001: IMG_0048.JPG (613895 IMG_0048.JPG 0001: IMG_0049.JPG (923896 _IMG_0049.JPG 0001: IMG_0050.JPG \»23897_IMG_0050.JPG 0001: IMG_0051.JPG \63898_IMG_0051.JPG 0001: IMG_0052.JPG |53899_IMG_0052.JPG 0001: IMG_0053.JPG \»33900_IMG_0053.JPG 0001: IMG_0054.JPG (613901 IMG _0054.JPG 0001: IMG_0055.JPG \»13902_IMG_0055.JPG 0001: IMG_0056.JPG \613903_IMG_0056.JPG 0001: IMG_0057.JPG (613916 IMG _0057.JPG 0002: IMG_0058.JPG \513904_IMG_0058.JPG 0002: IMG_0059.JPG \633905_IMG_0059.JPG 0002: IMG_0057.JPG 623920 _IMG_0057.JPG 0003: IMG_0060.JPG 1613906 IMG _0060.JPG 0003: IMG_0061.JPG \613907_IMG_0061.JPG 0003: IMG_0062.JPG 1613908 IMG_0062.JPG 0003: IMG_0063.JPG 1613909 IMG _0063.JPG 0003: IMG_0064.JPG 623910 _IMG_0064.JPG 0003: IMG_0065.JPG 163911_IMG_0065.JPG 0003: IMG_0066.JPG \623912_IMG_0066.JPG 0003: IMG_0067.JPG 163913 IMG_0067.JPG 0003: IMG_0068.JPG 1623914 IMG_0068.JPG 0003: IMG_0069.JPG [623915 IMG_0069.JPG 0004: IMG_0069.JPG 1623917_IMG_0069.JPG 0004: IMG_0070.JPG (623918 IMG_0070.JPG 0004: IMG_0071.JPG 633919 IMG_0071.JPG EFTA00128374

--=PAGE_BREAK=--

Case Disposal EFTA00128375