Date: Mon, 21 Oct 2019 4:01:12 PM(UTC) Sent: Mon, 21 Oct 2019 4:01:14 PM (UTC) Subject: RE: Keychain cracking --- UNCLASSIFIED From: To: ce: Classification: UNCLASSIFIED We tried to do an EC way back when, but the case classification did not allow for us to do it. The UCFN is 31E-NY-302757 (Epstein) Senior Forensic Examiner Office) Cell) (Fax) Sent: Monday, October 21,2019 11:32 AM Subject: RE: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED Hey there, DID we have an EC/Lead for this? Or a UCFN for tracking purposes Trying to document this for our records ( and yours potentially) Let me know Thanks Sent: Monday, October 2 T Subject: RE: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED 3503-011 Page | of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001898 EFTA00157083

--=PAGE_BREAK=--

I've said it before, and I'll say itagain. THERE IS NOBODY BETTER THAN YOU GUYS!!!! Thanks. The password you provided unlocked the drive. | owe you a beer Senior Forensic Examiner Sent: Monday, October 21,2019 11:14 AM Subject: RE: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED Good momin STXU has recovered a password “asdfasdfasdfasdf” (no quotes) for item NYC024364 Once your forensic analysis is complete, a brief summary (a few sentences) as to the value of STXU's efforts/password provided is appreciated when convenient. This helps STXU focus our expertise and streamline decryption efforts in support of future investigations. STXU will remove all copies of this data and considers this request complete. Please contact STXU for further dissemination of these results outside of the FBL. If you have any further questions, please If everything looks good and you have no further questions, please “remove HQCU-VAP permissions in the CAT tool”. IT Specialist / Senior Forensic Examiner Secure Technologies Exploitation Unit (STXU) Division (OTD) - Miam 3503-011 Page 2 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001899 EFTA00157084

--=PAGE_BREAK=--

Subject: RE: Keychain cracking --- UNCLASSIFIED Classification; UNCLASSIFIED ze can be found at nce/NYC024364 Itisa | TB EO! Yes, I'll make sure you have permissions, The im NYCART-FS/Cases01/ny-3027571_219047/Evic Senior Forensic Examiner Sent: Thursday, October 17,2019 11:58 AM To: Ce Subject: RE: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED Is the image on OPWAN so I can take a look at it? Thank you. Sent: Thursday, October 17,2019 11:56 AM To: Subject: RE: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED Itisn’t a T2 system, but I was having many difficulties acquiring the drive with Macquisition, so I had to remove the drive and use a TX1. This is not the late ncration of MacBook, I believe it is the generation right after they removed the CD drive, so it is recent, but not brand new. It is very possible that this was somebody else's machine, but without being able to browse the usernames, | can’t be 100 % certain Senior Forensic Examiner 3503-011 Page 3 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001900 EFTA00157085

--=PAGE_BREAK=--

(212)384-4838 (Office) (917)855-6666 (Cell) (212)384-1334 (Fax) From SE (OTD) (FBI) Sent: Thursday, October 17,2019 9:40 AM Subject: RE: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED Good morning Is this a T2 system as well? Also, do you have any indication of who the user of the laptop may have been? As I recall, there was at least one system that I looked at when I was working on the original request that was used by someone other than him. Please let me know Thank you! From Ss (NY) (FB) Sent: Wednesday, October 16,2019 12:55 PM Subject: RE; Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED ‘ I have another MacBook Pro that is locked for the same case. The password hint is “stroke4”. The passwords below did not work. Any help is appreciated. Thanks. Senior Forensic Examiner From ae Thursday, September 19 10:56 AM : Subject: RE: Keychain cracking --- UNCLASSIFIED 3503-011 Page 4 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001901 EFTA00157086

--=PAGE_BREAK=--

Classification: UNCLASSIFIED I'm glad we could be of assistanc Gi Please let us know if you need anything else and don’t forget to send us an update o nee your forensic analysis is complete, A brief summary (a few sentences) as to the value of STXU's efforts/password provided is appreciated when convenient as this helps STXU focus our expertise and streamline decryption efforts in support of future investigations Thank you, Sent: Thursday, September 05, 2019 10:50 AM Subject: RE: Keychain cracking --- UNCLASSIFIED Classification; UNCLASSIFIED You guys are g eat. The password “irving” worked. | am now in the machine and imag ng it. Thanks forall your help. I obviously could not have done it without you Senior Forensic Examiner From: Sent: Thursday, September 05, 2019 9:47 AM Te Ce Subject: RE: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED Oh yes, NYC024353 was the one with the user account JEE and I had already obtained the user password as part of your previous request which was ‘irving’ (no quotes). In his keychain he had the following passwords which you can try irvingirving neptunemermaid [this one was used extensively] asdfasdfasdf [this was used for a Gmail account yes8"tin [this was the password for his multiple AirPort routers} Please let me know your results once you try them so | can update our internal system accordingly regarding your request 3503-011 Page 5 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001902 EFTA00157087

--=PAGE_BREAK=--

Thank you! hursday, September 05,2019 8:53 AM Subject: RE: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED The machines in question are Macs running APFS, and their images are aff4 files. I have them here in Blacklight, but I car confirm which one because the Case Agents are using my one Blacklight machine to review. The images are NYC024353 and NYC024329. One of them has a user account of JEE ora similar username which is obviously the subject. If you have a list of possible passwords, could you forward that for me to try on the T2 iMac? From: : Thursday, September 05,2019 8:43 AM Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED Good morming their keychains) tha When I worked on your request I was able to recover several passwords for him from re to check? other systems (ar ere provided so I may already have it. Which ones did you want Let me know and I'll take a look at it IT Specialist / Senior Forensic Examine Secure Technologies Exploitation Unit (STXU) ( — Technology Division (OTD) - Miami 3503-011 Page 6 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001903 EFTA00157088

--=PAGE_BREAK=--

Sent: Wednesday, September 04, 2019 3:35 PM Subject: Keychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED You seem to be the Mac guy for your unit. Quick question. If] give you an un-encrypted image ofa Mac either in APFS or HFS+, would you be able to recover the password for the user account? | have multiple images of macs from Epstein, and they all have the same password hint. Figuring he just used the data migration tool and rolled everything along. Hope it can give usa password for a T2 iMac we can’t get an image of. z a oordinator Senior Forensic Examiner Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED 3503-011 Page 7 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001904 EFTA00157089

--=PAGE_BREAK=--

Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED 3503-011 Page 8 of 8 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001905 EFTA00157090