To: Ce: Subject: Ep atenT Seach Wala COC UTES Date: Friday, May 29, 2020 12:53:12 PM Attachments: EpsteinN Evidence. xlsx Updated item descriptions. Just a side note, many thumb drives and SD cards will not have a serial number visible externally, but will report one through our tools. | included those electronically reported serial numbers. Any questions, let me know FBI NY CART Coordinator Examiner a Sent: Friday, May 15, 2020 4:11 PM ee Subject: RE: Epstein search warrant documents | a 3503-024 Page | of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001961 EFTA00157144

--=PAGE_BREAK=--

From: Sent: Thursday, May an Subject: Re: Epstein search warrant documents Here is The listing of all the evidence gathered in NY that | have added some columns to guide you to the unique numbers CART NY uses fro their evidence. The template wasn't a slam dunk over, so | did what | could to convey the information. If you are confused by anything, please let me know. In the column for approximate size, it is in GB, totaled at the bottom and converted to TB. In the materials contained column, | put what load file group the data was transferred over in (Mac, Windows, Loose Media, IDE, or Blacklight) If there is no entry in that column, that data has yet to be transferred. There are 2 Macs and a DVR you don't have as well as an iPhone and an iPad. IF the descriptions are a bit light, let me know and I'll do what | can to beef them up. | will get you the Island stuff tomorrow. B} NY oordinator or Examiner 3503-024 Page 2 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001962 EFTA00157145

--=PAGE_BREAK=--

Sent: Wednesday, May 13, 2020 12:25 PM To: ES (\Y) () a; IID (UsANs) [Contractor Ce: A (SANS) i; ID (UsANys) wv) Subject: RE: Epstein search warrant documents Respectfully, | think there are some misc s here — all we have asked is to receive the IMMUNICAatic materials in a format such that we can vie w them using a sys to get web-enabled access through any FBI tool, so we asked for the materials to be transfer format so we could put them on Relativity, which both we and the agents can access. ed to have the files in a at we can produce them to defens en an issue. My understanding from [is that to do it now is just for us (the U.S. Attorney’s ma that in many other c and it hasn’ vious the best vendo way vill p Relativity. It doesn’t really have anything to do with the taint review—we have to have access to the Office) to get the original files h our ss—by which | just mean converting into file formats that are loadable onto docs in our systems for discovery purposes And we were happy to get the materials as they were processed, but when we received the 1.1 vere in a format that wasn’t usable for the reasons ton March 9. Again, | understand from jj that the best way forward naterials in their million documents earlier this year, they described in the email s to ju ies of iginal formats, which | understand will be seg and designated by device. That should work for us! | was just trying to understand the approach, as well as the timeline thanks, From: aS (\) ) Sent: Tuesday, May 12, 2020 13:03 0: TS USNS) i, I UsANys) [Contractor] < b> Ce: A (SANS) i ; II (UsANys) as. is fo (2) Subject: Re: Epstein search warrant documents Just to be clear. The US Attorney's Office (or it's contractors) are not "processing" anything. You are taking files that | will be extracting from processed evidence and putting them into an E-Discovery tool (Relativity) to do a taint review. 3503-024 Page 3 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001963 EFTA00157146

--=PAGE_BREAK=--

Relativity is NOT a forensic tool. It is incapable of dealing with many things that are found forensically on a computer like free space, slack space, and system files to name a few. When we started this, and you insisted you do the taint review in Relativity, | warned you that it was adding months worth of work on top of what was already done, and that Relativity was incapable of viewing everything. You insisted we do it this way. So now i and | have come up with a way to fit this round peg into this square hole. We will get it done. Sorry it has taken so long, but we are talking about terabytes worth of data over multiple forms of digital evidence. Phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers. We have gotten past encryption on multiple devices. When we review devices on such large cases, we usually do it piece by piece as things are processed, | was unaware that you didn't want to review as things were processed, that you wanted to do it "all at once", so that added to the delay. Sorry for that. Just a differentiation of methodology | suppose. HB 2nd | feel confident that the method we have come up with will be more consistent and preserve the attribution of files to devices and links of e-mails to attachments that the load file generation that | did a while back was lacking. FBI N¥ CART Coordinator Senior Examiner From: I (SAS) <r Sent: Tuesday, May 12, 2020 11:33 AM To: (NY) (FS) a I (UsANys) [Contractor] a Ce: A (SANS) i; I (UsANys) Ss CCti‘CCts Subject: RE: Epstein search warrant documents Okay, so just to check, you both think that there is not a need to do a test run? You're both comfortable with just basically sending us copies of everything? | don’t totally understand why we couldn't have done that eight months ago, but regardless of the passage of time, | want to make sure we understand so we can report to our supervisors. | assume that means that we (at the U.S Attorney’s Office and through contractors) will therefore need to do all the processing ourselves, correct? And thanks again to you both rom: aS (\) -) a Sent: Tuesday, May 12, 2020 11:30 To: EERE (USANYS) [Contractor] <i; [ae 3503-024 Page 4 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001964 EFTA00157147

--=PAGE_BREAK=--

(USANYS) <r CE SA'S) ST (U5A7S) Subject: RE: Epstein search warrant documents Like [J said in his earlier email. It will be the raw data and it will be marked so it is easier to attribute it to a particular device. Problem now is how to get the data to [J since he is teleworking. NY CART Coordinator Senior Forensic Examiner cell desk On May 12, 2020 11:15 AM (USANYS)" < > wrote: you do, but can you please tell us what that plan is? Thanks! From: eS (\) !) Sent: Tuesday, May 12, 2020 11:11 To: EE (USANYS) (Contractor) a; Ss (USANYS) <i Ce: TE (SANS) i ; a (UsAnys) Subject: RE: Epstein search warrant documents I will use the spreadsheet, no problem. [J and I ironed out all the details. We've got a good plan moving forward that will meet your needs. NY CART Coordinator Senior Forensic Examiner cell desk (USANYS)" > wrote: if you could pl he attached spreadsh etin transmitting that info so we make sure we get all the inf eed. | think you had previously sent us a list of certain information that ortunate ly wasn’t hi we want to make sure we’re all on the same page In terms of data transfer, [J are you just sending a literal « process and upload it on our end? | ask to make sure we don't Ic any searchability — when FBI sent versions before, it had already been processed. | think what we talked about on the phone a 3503-024 Page 5 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001965 EFTA00157148

--=PAGE_BREAK=--

month a for example, data from one device tor sure it transfers correctly, before sending r literally everything — is that still the pl thanks From: (SANS) (Contractor) > Sent: Tuesday, May 12, 2020 10:27 Cc: i (\\) (o) Subject: RE: Epstein search warrant documents Hello | | Me ar a st finished our pho the all of jata and where the dat | an begin to copy the data a data off of the hard drives Please let us know if there are any questions Thank you From: TS (SA'S) <r Sent: Friday, May 8, 2020 2:15 PM as (NY) (FS!) -; (UsAnys) (USANYS) ——"— Cc: (USANYS) (Contractor) x; PR (UsAnys) < (S°\) |) Subject: RE: Epstein search warrant documents Okay thanks — please do let us know if at any point that changes, otherwise we'll look forward to being ab eview the returns in early June. Thanks again From: a (VY) (53!) Sent: Friday, May 08, 2020 14 — —— (NY) (FBI) < -— — 3503-024 Page 6 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001966 EFTA00157149

--=PAGE_BREAK=--

Cc: EE (USANYS) (Contractor) <q; ER (SANs) | ee < ee es SS) |): Subject: RE: Epstein search warrant documents There has been talk of us returning to normal soon, so | don't think it will effect the timeline I initially gave you. If it does, I'll let you know. NY CART Coordinator Senior Forensic Examiner cell desk (USANYS)" On May 8, 2020 1:58 4 > wrote: o get that list on Thursday. As a refresh, the info we are Under hanks—it w ooking for is in the attached spre that the estimate of a month from longer likely? If so coulc factor that in? Thanks (on: aS (\\) 3) Sent: Friday, May 08, 2020 13:50 To: ES (SANS) <i; TS (SANs) > es )) o) a (USANYS) <a > Cc: EN (USANYS) [Contractor] i: I (USANYS) ee < SS) ee) | < Subject: RE: Epstein search warrant documents Sorry for the delay, they reduced us to | day a week, so things have been stretched out by a factor of 5. I will be back in the office on Thursday and will be able to get you the list then as I have to access some of our systems to do so. Also, BL please reach out to me at one of the numbers below so we can brain storm. Thanks. NY CART Coordinator Senior Forensic Examiner cell desk 3503-024 Page 7 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001967 EFTA00157150

--=PAGE_BREAK=--

, 2020 12:10 PM, " (USANYS)" > wrote: of the de vell as from his Fallowing up on the below, | think you had said you expected to be able to get us a lis i from the search warrants at Epstein’s residences in fork and the USVI, as person upon arrest, in about a month (during our conference call a month a — so wanted to check f we can still expect that 90n? We’re waiting on that list to be able to do an updated search Please let us know the current timeline — and also the current ts from t ou and expected we'd have it a couple warrant on all of those devi timeline =mber searches oducing the r ugust and were gol 0 coordinate on that, an had mentioned 1onths from our call, which would be about a month from now. Wanted to make sure we're still or track Sent: Tuesday, April 07, 2020 15:2 27 oS USS) a: I (SANs) > 2) a (USANYS) <a Cc: EY (USANYS) (Contractor) <q; EE (USAnys) S ____t___. Sd)—CSs on a eS (3) Subject: RE: Epstein search warrant documents et’s plan on 11am tomorrow morning, | am trying to get an FBI line with a larger capacity but | won't kn Thanks until tomorrow am. | will push it out when confirmed From: ES (USANYS) (:12t Sent: Tuesday, April 07, 2020 3:15 PM To: ES (NY) (3!) a; I (OSANys) Cc: ES (USANYS) [Contractor] aE ; Ss (SANS) a; TS <a ; Ss (USANYS) <i S ; a ('Y) (FS!) <> Subject: RE: Epstein search warrant documents Yes, |can do anytime tomorrow, and [ij IJ can also join anytime tomorrow So whenever is 3503-024 Page 8 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001968 EFTA00157151

--=PAGE_BREAK=--

on your end Also, we can host a conference call, but only up to six lines at a time — so if FBI has larger capacity than that let us know, otherwise I‘'d propose we do Sent: Tuesday, April 07, 2020 14:13 To: ES (USNS) a I (y) (81) a SS SS) a SS Cc: ES (USANYS) (Contractor) <q; EE (USAnys) ff (om > eS ()) (°)) < Subject: RE: Epstein search warrant documents Are you available tomorrow for a conference call to discuss this issue? ss\ i FBI New York On Apr 7, 2020 1:55 PM, " (USANYS)" > wrote: 1g up on this from a month rld than what existed e living in a different wo four weeks ago, but are you at all ab assist while working remotely? This has been pending for alme iths and we still don’t hav ice or item that was seized rf for which of tho but as a first spreadsheet we sent earlier (that’s also attached) and searche vappy to have a call if that would be us p the most basic ing for is the info in tt emplate thanks, From: ee (USANYS) 3503-024 Page 9 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001969 EFTA00157152

--=PAGE_BREAK=--

Sent: Monday, March 09, 2020 12:00 oS (.Y) (S) I (USA) a: ES): ) a (USANYS) <r Cc: (SAN YS) (Contractor) <>: EE (USANys) SS S\'') > es (3) <a Subject: RE: Epstein search warrant documents Unfortunately | don’t think this is very helpful to us. Did you take a look at the example spreadsheet | sent on 2/24? The excel file you sent has descriptions that don’t match up to the items listed in the search warrant returns (that we sent on 2/23), and we don’t have the 1B or CART numbers to be able to cross-reference. We also can’t tell what you mean by “loose media” without a specific comparison to what was seized, we don’t know which items you're referring to as “Windows machines,” and we can’t tell whether the entirety of any part ular item has been transferred, or just partial. For example, it looks like we have gotten very, very few image files, which is surprising We have also encountered some very significant problems in trying to review the more than 1 million documents we recently received: - The data we've received has no way to put any emails and attachments together. So if an email says, “see the attached flight records,” for example, we have no way of linking that up with the records themselves. Not only is that a big problem for us in review, it’s going to be a huge problem for producing the documents to defense counsel. - The load file has no link to the native file, so when we load the data to the database, there’s no way to have the native files show up in the database. Because many of the files are too arge to open in the viewer, it effectively means that there are many files that are completely nvisible to us. Related, the control numbers in the load file don’t match up to the native files. So we have two sets of numbers and no way to match up anything—that is, even if we were to try to go hunt down every individual large file in the native files, it would be impossible. So the data that we most recently got, we need to get in a form that addresses those issues, and we likely will need to get a similar reproduction of the data we received a couple months ago. Otherwise we're sifting through more than a million documents without much rhyme or reason. I've re-attached the spreadsheet we sent last week — | think that’s a good place to start in terms of our necessary record-keeping, and we need that info at the very least, as well as anything else you think would be useful. Also attaching the SW returns for reference. And again, we’re happy to meet up anytime and hash all this out in person if that’s useful. 3503-024 Page 10 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001970 EFTA00157153

--=PAGE_BREAK=--

thanks, = (on: eS (\Y) |!) Sent: Wednesday, March 04, 2020 16:36 oS (USNS) a; a (us ANys) ———_—_ Fi IT 7 (USANYS) <a Cc: EE (SAN YS) (Contractor) <j: ER (USAnys) a ES (Ss) | Subject: RE: Epstein search warrant documents rney’s Office for taint Here is a listing of what | have alread | vi oad e US Atte S cation: Th out to be 3¢ S found in the Manhattan in total) from a July the apartment is included. All the Windows machines from the NY apartment are included. Only 2 Macs apartm se media from the NY one of his properties. | only p from NY and 1 from the Island are included | will have o more closely coordinate with whoever is loading up Relativity with the remaining Macs as the tool they have to be processed with does not easily re-name the load files Spreadsheet is attached NYO CART Senior Forensi dinator aminer Sent: Tuesday, March 03, 2020 12:25 PM To (°°) 2) SS A (SANS (USANYS) <r Cc: EEE (USANYS) [Contractor] i; Sa <r io ff. gg | (USANYS) i aS (.y) (8!) <i Subject: RE: Epstein search warrant documents | could oft for u additional ste unting in advance reed — is that do Thursday morning, but | think it would be helpf eeting so we can figure out in advance what (if a 3503-024 age 11 of 15 Pa SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001971 EFTA00157154

--=PAGE_BREAK=--

From: i (\\) (3) Sent: Tuesday, March 03, 2020 09:59 To: AS (SANS) <i; I (SANS) Cc: EE (USANYS) (Contractor) <q; (sans) . __.._ ETT rDTTCS , re Subject: RE: Epstein search warrant documents Can we do Thursday morning? My network should be back by then and I can give you a good accounting. NY CART Coordinator Senior Forensic Examiner cell desk On Mar 2, 2020 11:15 AM, " (USANYS)" Doing the weekly check in on this — is there a time this week when everyone can meet on this? thanks, = From: ee (USANYS) Sent: Monday, February 24, 2020 17:38 To: ES (NY) (°C!) a ; a (USANys) a 2) a (USANYS) <i Cc: EE (SANs) [Contractor] <q: (says) ._ yf, @ (emo SS (2) <a Subject: RE: Epstein search warrant documents lly understand s—we can relate till think it will be helpful tc together to have an in-pe on, to make sur dy is on the same page cilitate that returns, w folks available for that ne t | think would be most helpful to n the tw spreadsheet of each separate device references search warrar columns for whether we’ve dumped the contents, whether t e been re ed and/o transferred, what portions were transferred, etc 3503-024 Page 12 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001972 EFTA00157155

--=PAGE_BREAK=--

you think would be useful — and th 2thing roughly like the attached, with any other categories oon the attached is r athetical, obviously, j amples. That will help us fully understand what’s been reviewed, transferred, and received so far, and what remains. {Also just on the pictures, we do want copies of those as well, please including from the discs an —| think FBI was going to do an initial screen to make sure no CP, and since | think the s no, we'll need to get those to be able to review them as well.) many thanks, = Fon: aS (2) Sent: Monday, February 24, 2020 09:24 To: ES (SANS) i; TS (SAYS) eS )) (2) a: (USANYS) <r Cc: EY (USANYs) (Contractor) <q; PY (Usanys) yf, @ (eno > (1) 2) <a Subject: RE: Epstein search warrant documents Sorry for the delayed response. They are tearing out our old network and giving us a new one, they mandated we delete old stuff (about 400 TB worth). Now that they are working on replacing the network, we can do only local work. I should be able to give you an accounting of what is what. I can say, off the top of my head, that all windows based items from the NY search have been handed over as well as all loose media. The CDs from NY only contained pictures, no documents. There are still some Apple items from NY that need to be produced. As far as the Island stuff goes, the Ist item on your spreadsheet, the "kitchen" mac has been produced. Still working on the rest. NY CART Coordinator Senior Forensic Examiner cell desk 2020 12:21 A (USANYS)" » last weekend, I’m still not su ng this so | or us to all sch e a (hopefully relatively brief} meeting to all get on the same page? We didn’t hear back on which files had previously been provided, but our tech folks did their best to differentiate, and we got access to the materials yesterday and its well over a million documents, and we don’t have an\ what we're looking at—i.e., devices the materials came from, whether it’s full or p =sults, how many 3503-024 Page 13 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001973 EFTA00157156

--=PAGE_BREAK=--

etc. Based on the attached search warrant returns, it looks like from the New York mansion (the PDF) there are approximately 40 devices that would have storage (computers, hard drives, thumb drives, etc.) and that’s not even counting at least 60+ CDs. And then from the Virgin Islands (the Excel spreadsheet), at least more than 25 devices, including multiple servers / server racks. So we gotta know what we've already received, what remains, anticipated schedule, etc, and | know it’s a lot of moving pieces on all sides so wanted to loop in everybody at once. The case team will be in California this coming week from Tuesday through Friday, but then | think generally around the first week of March, which will hopefully be plenty of time to schedule a productive meeting. thanks all, From: I (SANS) Sent: Saturday, February 15, 2020 16:30 To: ES (NY) (eT; IT (1) (81 iz Ce: EE (USANYS) [Contractor] i ; a SS (059s) <a: (S45) C(t‘ Subject: RE: Epstein search warrant documents I'm not sure who's the exact right person to ask this, so wanted to get everybody on one email chain about it — | have the hard drive that dropped off that has new Epstein search warrant materials, but it looks like there are also old materials (that | think we had previously received and uploaded??) on the hard drive, and so I’m not sure what's new. Just generally, and || and | talked about this last week too, but it’s basically impossible for us to keep track of what we’re getting, and what has been completed, without some kind of identification or labeling system, along with a list of which devices have been extracted and downloaded. So for example on the hard drive currently, there are 38 folders labeled “loadFiles” through “37loadFiles” with a modified date of 11/14/19, which | think we may have already previously received — but I’m not sure, because we haven’t gotten any info on which folders match up to which devices, etc. And then there’s another folder titled “NYCO24362” that has a modified date of 1/27/20, so | think that may be the materials we hadn't previously received? That folder by itself has more than 600,000 items. | don’t want to give J anything that we've already previously received and uploaded, and | can’t tell from the folder or file names whether everything on the drive is new, or whether just additional 3503-024 Page 14 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001974 EFTA00157157

--=PAGE_BREAK=--

materials were saved onto it in addition to what we already have. [J are you able to give us some guidance on this? Ultimately what we really need is a spreadsheet of every device, whether it’s been dumped (or partially dumped), and then identifying that same info — which device, and what materials from it — are being given to us with each data transfer. Otherwise | think organizationally and for review purposes it will be a total disaster for us. We're happy to have a meeting on this if that’s helpful — and thanks everybody for the assistance. Assistant U.S. Attorney Southern District of New York 3503-024 Page 15 of 15 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001975 EFTA00157158