U.S. Department of Justice Office of the Inspector General REPORT OF FORENSIC EXAMINATION SUBMITTER DATE SUBMITTED CASE Special Agent [EM New York Field Office | December 12,2019 | 2019-010614 UMBER OFFICE CONDUCTING EXAMINATION | CYBER ID SUBJECT(S) Cyber Investigations Office 0452 Correctional Officer Michael Thomas, Federal Bureau of Prisons, Metropolitan Correctional Center, New York, NY DIGITAL DEVICE(S) EXAMINED 1. EnCase Forensic Image of a Seagate SOOGB hard drive with the serial number Z6E8KD3N, which was extracted from a BOP owned HP EliteDesk 800, serial number 2UA4381XJW. (Device 1) 2. EnCase Forensic Image of a Hitachi S5O0GB hard drive with the serial number JP1572JE36LSNK, which was extracted from a BOP owned HP Compag 8200 Elite, serial number MXL14700DY. (Device 2) Synopsis On December 12, 2019, U.S. Department of Justice, Office of the Inspector General (OIG), New York Field Office Special Agent submitted a Digital Forensics Examination Request form seeking analysis of Devices | and 2. requested a search of Devices | and 2 for a timeline of user activity and work product from 8/9/2019 to 8/10/2019. | arranged for the seizure of Devices 1 and 2 under administrative authority from the Federal Bureau of Prisons (BOP), Metropolitan Correctional Center (MCC) located in New York, NY. Devices 1 and 2 were located and seized from the MCC’s Special Housing Unit where former inmate David Epstein was housed at the time of his suicide on August 10, 2019. | requested that CYBER determine user activity and attribution for each device prior to, at the time of, and subsequent to the discovery of Epstein’s body. further requested any communication and/or documents on the devices regarding Epstein, and requested the search of the keyword “Reyes.” OIG Lead Information Technology Specialist a. Cyber Investigations Office (CYBER), received the above referenced devices for analysis. Leonard successfully processed Devices 1 and 2 with CYBER’s forensic tools, and performed a forensic analysis on working copies of the devices. The analysis included a thorough review of system and user artifacts, which were used to create a preliminary summary timeline of user activity on each device. Leonard also identified documents containing the keyword Reyes. Leonard did not identify any communication between BOP personnel on the devices regarding Epstein. BOP uses GroupWise for email communication, SENSITIVE BUT UNCLASSIFIED EXAMINER NAME AND TITLE: | uTs REVIEWER NAME AND TITLE: | AsAc iii SIGNATURE: SIGNATURE: OIG Form I11-235/2 (02/10/17) _ This document contains neither recommendations nor conclusions of the IG. It is the property of the IG and is loaned to your agency; it and its contents are not to be distributed outside of your agency EFTA00128377

--=PAGE_BREAK=--

which does not cache locally to the computer system and was not recovered or analyzed as a result. User Email can be requested from BOP for separate analysis. Leonard generated reports of the documents containing the keyword Reyes and an Excel spreadsheet documenting the preliminary summary timeline information, which can be viewed by clicking this link. All documentation related to this forensic request will be retained by CYBER on the Archive Network Attached Storage located in the Dallas lab under this case number. A LIMA forensic case management system report containing all examiner process notes, photos, tool details and forms associated with this request is incorporated by reference, and has been provided to the requestor in electronic format with this report. The analysis results reports provided to a are also included in electronic format with this report. SENSITIVE BUT UNCLASSIFIED Page 2 Case Number: 2019-010614 EFTA00128378