From: PT Subject: Fwd: RE: Epstein search warrant documents Date: Tuesday, May 12, 2020 11:31:40 AM Gents, See the thread below as an FYI. NY CART Coordinator Senior Forensic Examiner cell desk (USANYS) (USANYS)" < HN (USANys)" | have no doubt you do, but can you please tell us what that plan is? Thanks! Sent: Tuesday, May 12, 2020 11:11 To: EE (USANYS) (Contractor) (>: Cc: RE (SANS) a: a PY (Usanys) Subject: RE: Epstein search warrant documents I will use the spreadsheet, no problem. | | and I ironed out all the details. We've got a good plan moving forward that will meet your needs. NY CART Coordinator Senior Forensic Examiner cell desk On May 12, 2020 10:34 AM, "| HE, it would be transmitting that in o we make sure we get all the inf (USANYS)" > wrote: very helpful for us if you could please use the attached spreadsh eet in ed. | think you had previously sent ormation that unfortunately wasn’t helpful for us, so we want to make sure st of certair e all on the same page 3503-021 Page | of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001936 EFTA00157120

--=PAGE_BREAK=--

In terms of data transfer proces sent pload it on our end? s and FBI re, it had alreac | think what w ons d about on the phone a n one device to make sure it transfers correctly, before month ago was getting, for example, data sending over literally everything — is that still the plan? thanks From: (USANYS) [Contractor] Sent: Tuesday, May 12, 2020 10:27 Subject: RE: Epstein search warrant documents Hello nd MJ just finished our phone call regarding the data. J will e data and where the data was ted. | will work to send some hard drives to put together a list of e can begin to copy the data and send it to us. | will need to figure out a way to get the data off of the hard drives Please let us know if there are any questions Thank you = From: a (SANS) <i _ Friday, May 8, 2020 2:15 PM — ————F ——""S _ (USANYS) <r Cc: EE (USANYS) (Contractor) <q; GR (USANys) a es < | ee (SS) a 8.) <a Subject: RE: Epstein search warrant documents Okay thanks — plea » let us know if at any point that changes, otherwise we'll look forward to being able to review the returns in early June. Thanks again 3503-021 Page 2 of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001937 EFTA00157121

--=PAGE_BREAK=--

Sent: Friday, May 08, 20 To: ES (SANS) a; I (SAYS) ee ee ee nn _ Cc: EE (USANYS) (Contractor) <x; ER (USAnys) es < | a (SS) ee | Subject: RE: Epstein search warrant documents There has been talk of us returning to normal soon, so | don't think it will effect the timeline I initially gave you. If it does, I'll let you know. NY CART Coordinator Senior Forensic Examiner cell desk On May 8, 2020 1:58 PM, "| (USANYS)" > wrote: Unde thanks—it will be grea 2et that list on Thursday. As a refresh, the info we are ooking for is in the attached s: plate eads the returns themselves, do ges you mentioned mean that the estimate of a month from mplete transmission arch warrant returns et us know what the current estimate would be, s ye can factor that in? Thanks very much Sent: Friday, May 08, 2020 13:50 To: ES (SANS) i; a (SANs) rr eee eee ee (USANYS) <> Cc: RE (USANYS) (Contractor) x: BR (Usanys) . yf qT few a eS (2) Subject: RE: Epstein search warrant documents Sorry for the delay, they reduced us to | day a week, so things have been stretched out by a factor of 5. I will be back in the office on Thursday and will be able to get you the list then as I have to access some of our systems to do so. Also, [BB please reach out to me at one of the numbers below so we can brain storm. Thanks. Pa of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 3503-021 age 3 EFTA_00001938 EFTA00157122

--=PAGE_BREAK=--

NY CART Coordinator Senior Forensic Examiner cell desk (USANYS)" > wrote: think warrants at e able to get us a list of the devi ¥ York and the USV g up on tk had said you expected t zed from the searc Epstein’s residences in as well as from his — so wanted to check n about a month ice call a month a In arrest ct that erson ing our co ry soon? We're waiting on that list to be able to do an updated search f we can still ex Please let us know the current timeline — and also the current 1 have it a couple warrant on all of those devices jJucing the results from those August and September timeline rdinate on that, and had mentione » make sure we’re still on call, which would be about a month from now. Wante a Tuesday, April 07, 2020 15:27 — ——————] _——-s —— | (USANYS) <> Cc: RE (USANYS) (Contractor) <>; (SANs) ETS a TG | ee): < Subject: RE: Epstein search warrant documents Ok let’s plan on 11am tomorrow morning, | am trying to get an FBI line with a larger capacity but | won't know until tomorrow am. | will push it out when confirmed Thanks = From: IS (SANS) (xtc is a Tuesday, April 07, 2020 3:15 PM SANS) 3503-021 Page 4 of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001939 EFTA00157123

--=PAGE_BREAK=--

Subject: RE: Epstein search warrant documents nd (I EM can also join anytime tomorrow. So wheneve anytime tomorrow, a end Also, we can host a conference call, but only up to six lines at a time — so if FBI has larger capacity than that let us know, otherwise I’d propose we do ts to join (and if not, one of I / ED) SS (USANYS) <a Cc: I (USANYS) (Contractor) i, ; SI (USANYS) a <4.) a es 3) Subject: RE: Epstein search warrant documents Are you available tomorrow for a conference call to discuss this issue? Ss\ i FBI New York On Apr 7, 2020 1:55 PM, " (USANYS)" > wrote: Following up on this from a month ago —| know we're living in a different world than what existed four weeks ago, but are you at all able to assist while working remotely? This has been pending for Sic list o ice or item that was seized tep the most basic thing we're looking for is the info in th two months and we still don’t have a almos and searc would be ds rf for which of those wi 1 materia he ve re e’re happy to have a call if that but as a first emplate spreadsheet we sent earlier (that’s also attached) 3503-021 Page 5 of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001940 EFTA00157124

--=PAGE_BREAK=--

thanks, = From: iS (USANYS) Sent: Monday, March 09, 2020 12:00 <a: I (0541S) ee eee (USANYS) <r Cc: EE (SAN YS) (Contractor) <j: EE (USAnys) pf 9 | [oD > eS ()) (:)) < Subject: RE: Epstein search warrant documents Unfortunately | don’t think this is very helpful to us. Did you take a look at the example spreadsheet | sent on 2/24? The excel file you sent has descriptions that don’t match up to the items listed in the 2/23), and we don’t have the 1B or CART numbers to be search warrant returns (that we sent on able to cross-reference. We also can’t tell w shat you mean by “loose media” without a specific comparison to what was seized, we don’t know which items you're referring to as “Windows ticular item has been transferred, or just machines,” and we can’t tell whether the entirety of any pa partial. For example, it looks like we have gotten very, very few image files, which is surprising. We have also encountered some very significant problems in trying to review the more than 1 million documents we recently received The data we've received has no way to put any emails and attachments together. So if an email says, “see the attached flight records,” for example, we have no way of linking that up with the records themselves. Not only is that a big problem for us in review, it’s going to be a huge problem for producing the documents to defense counsel. The load file has no link to the native file, so when we load the data to the database, there’s no way to have the native files show up in the database. Because many of the files are too arge to open in the viewer, it effectively means that there are many files that are completely nvisible to us. ontrol numbers in the load file don’t match up to the native files. So we have - Related, the two sets of numbers and no way to match up anything—that is, even if we were to try to go hunt down every individual large file in the native files, it would be impossible So the data that we most recently got, we need to get in a form that addresses those issues, and we likely will need to get a similar reproduction of the data we received a couple months ago. Otherwise we're sifting through more than a million documents without much rhyme or reason I've re-attached the spreadsheet we sent last week —! think that’s a good place to start in terms of 3503-021 Page 6 of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001941 EFTA00157125

--=PAGE_BREAK=--

our necessary record we need that info at t yell as anything else you ping, ar 30 attaching the V returns for re gain, we’re happy to meet up anytime and hash all this out in person if that’s useful thanks, = Sent: Wednesday, March 04, 2020 16:36 10: ES (SANS) a; I (SANS) es <a (USANYS) <r Cc: EE (USANYS) (Contractor) <j: ER (sans) a a <0 52) SS ES (.y) (5!) < Subject: RE: Epstein search warrant documents rin load f the US Attorney's Office for taint DE hard driv (9 dri s a listing of what | have already S clarification: Th to be 3 cor Manhattan S$ found int in total) from a July 200 All the se media from the NY one of his properties. | only pro apartment is included. All the Windows machines from the NY apartment are included. Only 2 Macs from NY and 1 from the Island are included | will have to more closely coordinate with whoever is loading up Relativity with the ocessed with does not easily re-name the load files remaining Macs as the tool they hav Spreadsheet is attached NYO CART Coordinator Senior Forensi aminer From: IS (USANYS) (i rs Sent: Tuesday, March 03, 2020 12:25 PM (USANYS) < -———_- a - Dil — a (SANS) i; a (\Y) S!) a Subject: RE: Epstein search warrant documents 3503-021 Page 7 of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001942 EFTA00157126

--=PAGE_BREAK=--

| could do of the meeting s Thursday morning, but | think it wo! be helpful for us to get the accounting n acvance we can figure out in adva vat (if any) additional steps we need — is that possible? Sent: Tuesday, March 03, 2020 09:59 g_——___ cn) (san) —S Cc: EE (USANYS) (Contractor) x; (USAnys) a <<) EC eC Subject: RE: Epstein search warrant documents Can we do Thursday morning? My network should be back by then and I can give you a good accounting. NY CART Coordinator Senior Forensic Examiner cell desk On Mar 2, 2020 11:15 AM, " (USANYS)" > wrote: Doing the weekly check in on this —is there a time t 1 everyone can meet on this? thanks, = From: I (USANYS) a Monday, February 24, ‘ a —- ig ‘S) pela [Cont ractor) >; i (SANs) > es < | ee (SS) ee) 2) Subject: RE: Epstein search warrant documents Totally understand about the network issues—we can relate. | do still think it w 1elpful to all sit n discussion, to make sure everybody is on the same page what | think would be most helpful to facilitate that w 3503-021 Page 8 of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001943 EFTA00157127

--=PAGE_BREAK=--

with been reviewed and/or be a spreadsheet of each separate device referenced in the two search warrant returns. columns for whether we’ve dumped the contents, whether t transferred, what portions were transferred, etc useful — and the Something roughly like the attached, with any other categories you think would be nfo on the attached is mostly hypothetical, obviously, just amples. That will help us fully understand what’s been reviewed, transferred, and received so far, and what remains {Also just on the pictures, we do want copies of those as well, please including from the discs and the de —| think FBI was going to do an initial screen to make sure no CP, and since | think the an was no, we'll need to get those to be able to review them as many thanks, = Sent: Monday, February 24, 2020 09:24 0: A (SANS) a; TT (SANS) (USANYS) <x Cc: EY (USANYS) (Contractor) qx; (USANys) ff. té—Smr?~—CrSse a 2) <a Subject: RE: Epstein search warrant documents Sorry for the delayed response. They are tearing out our old network and giving us a new one, they mandated we delete old stuff (about 400 TB worth). Now that they are working on replacing the network, we can do only local work. I should be able to give you an accounting of what is what. I can say, off the top of my head, that all windows based items from the NY search have been handed over as well as all loose media. The CDs from NY only contained pictures, no documents. There are still some Apple items from NY that need to be produced. As far as the Island stuff goes, the Ist item on your spreadsheet, the "kitchen" mac has been produced. Still working on the rest. NY CART Coordinator Senior Forensic Examiner cell desk On Feb 23, 2020 12:21 A (USANYS)" < > wrote: Team, Following up ont ow from last weekend, I’m still not sure how we're addressing this so | thought it would make sense for us to all schedule a (hopefully relatively brief) meeting to all get on 3503-021 Page 9 of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001944 EFTA00157128

--=PAGE_BREAK=--

the same page? We didn’t hear back on which files had previously been provided, but our tech folks did their best to differentiate, and we got access to the materials yesterday and its well over a million documents, and we don’t have any idea what we’re looking at —i.e., which devices the materials came from, whether it’s full or partial results, how many more devices we have coming, etc. Based on the attached search warrant returns, it looks like from the New York mansion (the PDF) there are approximately 40 devices that would have storage (computers, hard drives, thumb drives, etc.) and that’s not even counting at least 60+ CDs. And then from the Virgin Islands (the Excel spreadsheet), at least more than 25 devices, including multiple servers / server racks. So we gotta know what we've already received, what remains, anticipated schedule, etc, and | know it’s a lot of moving pieces on all sides so wanted to loop in everybody at once. The case team will be in California this coming week from Tuesday through Friday, but then | think generally around the first week of March, which will hopefully be plenty of time to schedule a productive meeting. thanks all, From: SS (USANYS) Sent: Saturday, February 15, 2020 16:30 To: es <a es (\Y) (FS!) a Cc: EE (USANYS) [Contractor] i; SS ES (55'S) (SANS) tC“ SC Subject: RE: Epstein search warrant documents I'm not sure who's the exact right person to ask this, so wanted to get everybody on one email chain about it —! have the hard drive that dropped off that has new Epstein search warrant materials, but it looks like there are also old materials (that | think we had previously received and uploaded??) on the hard drive, and so I’m not sure what's new. Just generally, and [J and | talked about this last week too, but it’s basically impossible for us to keep track of what we’re getting, and what has been completed, without some kind of identification or labeling system, along with a list of which devices have been extracted and downloaded. So for example on the hard drive currently, there are 38 folders labeled “loadFiles” through “37loadFiles” with a modified date of 11/14/19, which | think we may have already previously received — but I’m not sure, because we haven’t gotten any info on which folders match up to which devices, etc. And then there’s another folder titled “NYCO24362” that has a modified date of 1/27/20, so | think that may be the materials we hadn't previously received? That folder by itself has 3503-021 Page 10 of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001945 EFTA00157129

--=PAGE_BREAK=--

more than 600,000 items. | don’t want to give J anything that we've already previously received and uploaded, and | can’t tell from the folder or file names whether everything on the drive is new, or whether just additional materials were saved onto it in addition to what we already have. | are you able to give us some guidance on this? Ultimately what we really need is a spreadsheet of every device, whether it’s been dumped (or partially dumped), and then identifying that same info — which device, and what materials from it — are being given to us with each data transfer. Otherwise | think organizationally and for review purposes it will be a total disaster for us. We're happy to have a meeting on this if that’s helpful — and thanks everybody for the assistance. Assistant U.S. Attorney Southern District of New York 3503-021 Page 11 of 11 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001946 EFTA00157130