From: To: Subject: Re: Epstein search warrant documentsPau! (i > Date: Tuesday, April 7, 2020 2:12:42 PM Ok great, I'll see when they're available tomorrow. s\ iii FBI New York On Apr 7, 2020 2:11 PM, iS " -E wrote: = I'm in tomo rrow from 7:30 to 4. I'll be able to answer better from the office as I'll be able to ailable whenever. look at the evidence live. i'll make myself a FBI NY CART Coordinator Senior Examiner Sent: Tuesday, April 7, 2020 2:0 ce > — ——_s Subject: FW: Epstein search warrant document > think a conference call would be appropriate for this, can you let me know if that works for you and what ¢ rom: TT | ae Tuesday, April 07, 2 ___f Ll Subject: RE: Epstein search warrant documents orld than what existed 1g up on this from a month ago — |! know \ ving in a diff while working remotely? This has been pending for 5; ago, but are you at all able to assis 3503-020 Page | of 7 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001929 EFTA00157113

--=PAGE_BREAK=--

almost two months and still don’t have a very basic list of each device or item that was seized and searched, or for which of those we've received materials. We're happy to have a call if that |, but as a first step the most basic thing we're looking for is the info in the template spreadsheet w \t earlier (that’s also attached) thanks, = From: IS (USANYS) Sent: Monday, March 09, 2020 12:00 To: a, <>; es (SANS) EE ee <->: ee (USANYS) Cc: RE (USANYS) (Contractor) <j; ER (Usanys) | es <> (SS) > Subject: RE: Epstein search warrant documents Unfortunately | don’t think this is very helpful to us. Did you take a look at the example spreadsheet 4? The that c search warrant returns ( n’th file you sent has descrip ‘t match up to the items listed in the = the 1B or CART numbers to be media” without a specific | sent on 2/ able ‘re referring to as “Windows comparison to what w s seized, we don’t know which items yo | machines,” and we ca jhether the entirety of any particular item has been transferred, or just partial. For example, it looks like we have gotten very, very few image files, which is surprising. We have also encountered some v ry significant problems in trying to review the more than 1 million documents we recently received The data we've received has no way to put any emails and attachments together. So if an email says, “see the attached flight records,” for example, we have no way of linking that up with the records themselves. Not only is that a big problem for us in review, it’s going to be a huge problem for producing the documents to defense counsel - The load file has no link to the native file, so when we load the data to the database, there’s no way to have the native files show up in the database. Because many of the files are too arge to open in the viewer, it effectively means that there are many files that are complet nvisible to us. Related, the control numbers in the load file don’t match up to the native files. So we have two sets of numbers and no way to match up anything—that is, even if we were to try to go hunt down every individual large file in the native files, it would be impossible 3503-020 Page 2 of 7 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001930 EFTA00157114

--=PAGE_BREAK=--

tin a form that addresses those issues, and we é data that w ost recently got, we need to g a similar reproduction of the data we rec likely will need to Otherwis ple months ago re sifting through more than a million documents without much rhyme or reason I've re-attached the spreadsheet we sent last week —! think that’s a good place to start in terms of we need that info at t st, as well as anything els you think would be useful. Also attaching the SW returns for refe And again, we’re happy to meet ytime and hash all this out in person if that’s useful Sent: | Wednesday, March 04, 2020 16:36 To: ES (SANS) i; I (SANs) EE ee eee: eee (USANYS) Cc: EE (USANYS) (Contractor) <>; GR (USAnys) eee Subject: RE: Epstein search warrant documents taint Here is a listing of what | have alrea clarification: ints o apartme s in total) from a search on one of hi All the lo a from the NY apartment is included. All the Windows machines from the NY apartment are included. Only 2 Macs from NY and 1 from the Island are included nate with w g up Relativity with the | will hav remaining Macs as the tool they have to é to more closely coc essed with does not easily re-name the load files Spreadsheet is attached NYO CART Coordinator Senior Forensi aminer From: iS (SAN) es Sent: Tuesday, March 03, 2020 12:25 PM TS a TE (S41) a a (USANYS) <r 3503-020 Page 3 of 7 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001931 EFTA00157115

--=PAGE_BREAK=--

Subject: RE: Epstein search warrant documents could do Thursday morning, but | think it would be helpful for us to get the accounting in advance of the meeting so we can figure out in advance what (if any) additional steps we need —is that Sent: Tuesday, March 03, 09:59 To: ES (USANS) i; TS (UsANys) Cc: EE USANYS) (Contec) I: I (says) a a - ee: a USANYS) Subject: RE: Epstein search warrant documents Can we do Thursday morning? My network should be back by then and I can give you a good accounting. NY CART Coordinator Senior Forensic Examiner cell desk On Mar 2, 2020 11:15 AM," (USANYS)" > wrote: Doing the weekly check in on this — is there a time this week when eve meet on this? thanks, Sent: ‘Monday, February TT — |__—e Cc: NE (USANYS) [Contractor] <> ; [RIMM (USANYS) j—_2 '~w—— a: ae USANYS) Subject: RE: Epstein search warrant documents 3503-020 Page 4 of 7 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001932 EFTA00157116

--=PAGE_BREAK=--

Totally understand about the network issues—we can relate. | do still think it will be helpful to all sit down tog n discussion, dy is on the sare page. Are er to have an in-pe folks available for that next week? And what | think would be most helpful to facilitate that would arch warrant returns, with eparate device referen rthet be a spreadsheet of eac columns for whether w dumped the contents, v transferred, what portions were transferred, etc e Something roughly like the attached, with any other categories you think would be useful — and the nfo on the attached is r pothetical, obviously, just as examples. That will help us fully understand what’s been reviewed, transferred, and received so far, and what remains. {Also just on the pictures, we do want copies of those as well, please including from the discs and the devices —! think FBI was going to do an initial screen to make sure no CP, and since | think the need to get those to able to review them as well.) ans many thanks, = Sent: Monday, February 24, 2020 09:24 To: ES (SNS) a; TT (SANS) (USANYS) <i Cc: EE (USANYS) (Contractor) <j; RY (Usanys) a <<") Subject: RE: Epstein search warrant documents Sorry for the delayed response. They are tearing out our old network and giving us a new one, they mandated we delete old stuff (about 400 TB worth). Now that they are working on replacing the network, we can do only local work. I should be able to give you an accounting of what is what. I can say, off the top of my head, that all windows based items from the NY search have been handed over as well as all loose media. The CDs from NY only contained pictures, no documents. There are still some Apple items from NY that need to be produced. As far as the Island stuff goes, the Ist item on your spreadsheet, the "kitchen" mac has been produced. Still working on the rest. NY CART Coordinator Senior Forensic Examiner cell desk On Feb 23, 2020 12:21 AM, "(EEE (Us anys)" 3503-020 Page 5 of 7 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001933 EFTA00157117

--=PAGE_BREAK=--

Team, Following up on the below from last weekend, I’m still not sure how we're addressing this so | thought it would make sense for us to all schedule a (hopefully relatively brief) meeting to all get on the same page? We didn’t hear back on which files had previously been provided, but our tech folks did their best to differentiate, and we got access to the materials yesterday and its well over a million documents, and we don’t have any idea what we’re looking at —i.e., which devices the materials came from, whether it’s full or partial results, how many more devices we have coming, etc. Based on the attached search warrant returns, it looks like from the New York mansion (the PDF) there are approximately 40 devices that would have storage (computers, hard drives, thumb drives, etc.) and that’s not even counting at least 60+ CDs. And then from the Virgin Islands (the Excel spreadsheet), at least more than 25 devices, including multiple servers / server racks. So we gotta know what we've already received, what remains, anticipated schedule, etc, and | know it’s a lot of moving pieces on all sides so wanted to loop in everybody at once. The case team will be in California this coming week from Tuesday through Friday, but then | think generally around the first week of March, which will hopefully be plenty of time to schedule a productive meeting thanks all, From: Es (USANYS) Sent: Saturday, February 15, 2020 16:30 Co: LS <>; a Cc: ES (USANYS) [Contractor] >; a’ SS (S\\'S) <a: (SANs) SC(itsS Subject: RE: Epstein search warrant documents I'm not sure who's the exact right person to ask this, so wanted to get everybody on one email chain about it — | have the hard drive that [J dropped off that has new Epstein search warrant materials, but it looks like there are also old materials (that | think we had previously received and uploaded??) on the hard drive, and so I’m not sure what's new. Just generally, and [J and | talked about this last week too, but it’s basically impossible for us to keep track of what we're getting, and what has been completed, without some kind of identification or labeling system, along with a list of which devices have been extracted and downloaded. 3503-020 Page 6 of 7 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001934 EFTA00157118

--=PAGE_BREAK=--

So for example on the hard drive currently, there are 38 folders labeled “loadFiles” through “37loadFiles” with a modified date of 11/14/19, which | think we may have already previously received — but I’m not sure, because we haven't gotten any info on which folders match up to which devices, etc. And then there’s another folder titled “NYCO24362” that has a modified date of 1/27/20, so | think that may be the materials we hadn't previously received? That folder by itself has more than 600,000 items. | don’t want to give J anything that we've already previously received and uploaded, and | can’t tell from the folder or file names whether everything on the drive is new, or whether just additional materials were saved onto it in addition to what we already have. | are you able to give us some guidance on this? Ultimately what we really need is a spreadsheet of every device, whether it’s been dumped (or partially dumped), and then identifying that same info — which device, and what materials from it — are being given to us with each data transfer. Otherwise | think organizationally and for review purposes it will be a total disaster for us. We're happy to have a meeting on this if that’s helpful — and thanks everybody for the assistance. Assistant U.S. Attorney Southern District of New York 3503-020 Page 7 of 7 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001935 EFTA00157119