From: Po To: _ Ce: ee Subject: Fwd: RE: Epstein search warrant documents Date: Wednesday, June 17, 2020 2:39:17 PM ma. I know you already got this, just wanted to confer with you as to what is going on with all this. Feel like you, me, and J need to chat and see what is what. I'm thinking that this started before the case took a turn yet {J is still moving in the same direction. In other words, do we really need to be doing this? Seems to me that I should be taking all my marching orders from [J and a. NY CART Coordinator Senior Forensic Examiner cell desk weeeeene ee Forwarded message ---------- Date: Jun 17, 2020 2:28 PM (USANYS) (USANYS)" Sent: Monday, June 01, 2020 16:28 3503-027 Page | of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001994 EFTA00157176

--=PAGE_BREAK=--

Subject: RE: Epstein search warrant documents Will do. NY CART Coordinator Senior Forensic Examiner cell desk On Jun 1, 2020 4:26 PM, ") (USANYS)" > wrote: Underst and thanks for letting us know. Let’s keep in touch both on timing and also on whether there's a way to identify and categorize what's already been produced, or if we'll need to just get a the raw data at this stage and go from there. Sent: Monday, June 01, 2020 16:23 (USANYS) <r 2 QT (uu. «§ ES OS) a Subject: RE: Epstein search warrant documents Zz. Unfortunately, recent events and our staffing levels have conspired to put a kink in just about everything. If we can't make heads or tails of the stuff I've already produced, we'll do it again. They have told us that our staffing levels will be steadily increasing over the next few weeks, but I'm going to have to push back my estimate by a week or 2. Sorry about that. My next day in the office is Thursday, so I'll be able to see if I can easily identify what I already gave you and marry it to a reliable identifier. NY CART Coordinator Senior Forensic Examiner cell desk 2020 4:13 PM, " (USANYS)" On Jun 1, > wrote: Thanks for this update — we'll take a look and circle back if any questions parately, to follow up on a question from the May 15 email below, the list has just five devices as still pending to be transferred to us, and | think it’s right that the plan is to reproduce all the 3503-027 Page 2 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001995 EFTA00157177

--=PAGE_BREAK=--

materials so that we can get them in searchable format, but just wanted to confirm? Currently, we aren the prior productions to specific devices — so if we’re able to match them that might work, but otherwise | think it makes sense for us with that up by Bates number now, to get everything. Bu w if any issue /e still on track to get the range of data in the next week or Andr otten any updates on that status in the past few weeks, and we're eager to sor be able to start r © viewing thanks again, From: ee < Sent: Friday, May 29, 2020 12:53 Me ee [Contractor] (i> 5 Subject: Re: Epstein search warrant documents Updated item descriptions. Just a side note, many thumb drives and SD cards will not have a serial number visible externally, but will report one through our tools. | included those electronically reported serial numbers. Any questions, let me know. FBI NY CART Coordinator Senior Examiner Sent: Friday, May 15, 2020 4:11 PM Ce A (US'S) ms (5005) ee TTETTrT—C FS Ys) Subject: RE: Epstein search warrant documents 3503-027 Page 3 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001996 EFTA00157178

--=PAGE_BREAK=--

3 | 3 Sent: Thursday, May 14, 2020 15:54 warrant documents Here is The listing of all the evidence gathered in NY that | have. | added some columns to guide you to the unique numbers CART NY uses fro their evidence. The template wasn't a slam 3503-027 Page 4 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001997 EFTA00157179

--=PAGE_BREAK=--

dunk over, so | did what | could to convey the information. If you are confused by anything, please let me know. In the column for approximate size, it is in GB, totaled at the bottom and converted to TB. In the materials contained column, | put what load file group the data was transferred over in (Mac, Windows, Loose Media, IDE, or Blacklight) If there is no entry in that column, that data has yet to be transferred. There are 2 Macs and a DVR you don't have as well as an iPhone and an iPad. IF the descriptions are a bit light, let me know and I'll do what | can to beef them up. ! will get you the Island stuff tomorrow. FBI N¥ CART Coordinator Senior Examiner From: I (US5\ S) <i Sent: Wednesday, May 13, 2020 12:25 PM [0 : <i (SANS) [Contractor a Ce: A (USANYS) <i (USA's) re <>; ee LO”) Subject: RE: Epstein search warrant documents Respectfully, | think there are some miscommunications here — all we have asked is to receive the materials in a format such that we can view them using a system we have access to. We're not able to get web-enabled access through any FBI tool, so we asked for the materials to be transferred in a oadable format so we could put therm on Relativity, which both we and the agents can access. We're required to have the files in a format that we can produce them to defense counsel. I've done that in many other cases and it hasn’t previously been an issue. My understanding from || is that the best way to do it now is just for us (the U.S. Attorney’s Office) to get the original files, which our vendor will process—by which | just mean converting into file formats that are loadable onto Relativity. It doesn’t really have anything to do with the taint review—we have to have access to the docs in our systems for discovery purposes And we were happy to get the materials as they were processed, but when we received the 1.1 million documents earlier this year, they were in a format that wasn’t usable for the reasons described in the email | sent on March 9. Again, | understand from | | that the best way forward s to just get copies of the materials in their original formats, which | understand will be segregated and designated by device. That should work for us! | was just trying to understand the approach, as well as the timeline thanks, 3503-027 Page 5 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001998 EFTA00157180

--=PAGE_BREAK=--

From: es) < Sent: Tuesday, May 12, 2020 13:03 10: ES USNS) a: TT (SANS) [Contractor] (> Cc: A (SANS) i; I (UsANS) eS — ee—SX——— (F6)) Subject: Re: Epstein search warrant documents | Just to be clear. The US Attorney's Office (or it's contractors) are not "processing" anything. You are taking files that | will be extracting from processed evidence and putting them into an E-Discovery tool (Relativity) to do a taint review. Relativity is NOT a forensic tool. It is incapable of dealing with many things that are found forensically on a computer like free space, slack space, and system files to name a few. When we started this, and you insisted you do the taint review in Relativity, | warned you that it was adding months worth of work on top of what was already done, and that Relativity was incapable of viewing everything. You insisted we do it this way. So now [and | have come up with a way to fit this round peg into this square hole. We will get it done. Sorry it has taken so long, but we are talking about terabytes worth of data over multiple forms of digital evidence. Phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers. We have gotten past encryption on multiple devices. When we review devices on such large cases, we usually do it piece by piece as things are processed, | was unaware that you didn't want to review as things were processed, that you wanted to do it "all at once", so that added to the delay. Sorry for that. Just a differentiation of methodology | suppose. HEB and | feel confident that the method we have come up with will be more consistent and preserve the attribution of files to devices and links of e-mails to attachments that the load file generation that | did a while back was lacking. FBI N¥ CART Coordinator Senior Examiner From: I (SAS) <_es - Sent: Tuesday, May 12, 2020 11:33 AM 3503-027 Page 6 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001999 EFTA00157181

--=PAGE_BREAK=--

Subject: RE: Epstein search warrant documents ed to do 1g us copies of everything? | do but you both think that there is not an tb done that eight months a asically lly unc ardless of the passage of time, | want to make | assume that means that we (at t ntractors) will therefore need to do all the proc oth ce and through co g ourselves thanks again to Sent: Tuesday, May 12, 2020 11:30 SANS) CE SANS) SS (SANS) Subject: RE: Epstein search warrant documents Like J said in his earlier email. It will be the raw data and it will be marked so it is easier to attribute it to a particular device. Problem now is how to get the data to [J since he is teleworking. NY CART Coordinator Senior Forensic Examiner cell desk On May 12, 2020 11:15 AM, " (USANYS)" > wrote: | have no doubt you do, but can you please tell us what that plan is? Thanks! Sent: Tuesday, May 12, 2020 11:11 (USANYS) — Ce: A (SANS) i; I (UsANys) Subject: RE: Epstein search warrant documents I will use the spreadsheet, no problem. | | and I ironed out all the details. We've got a good 3503-027 Page 7 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002000 EFTA00157182

--=PAGE_BREAK=--

plan moving forward that will meet your needs. NY CART Coordinator Senior Forensic Examiner cell desk 2, 2020 10 On May (USANYS)" GE it wouldb transmitting that info so we make sure we get all the infc he attached spreadsheet in eed. | think you had previously us a list of certain information that unfortunately wasn’t helpful for us, so we want to make sure we’re all on the same page In terms of data transfer, JJ are you jus process and upload it on our end? | ask to make sure we don’t lose any searchability — when FBI sending a literal copy of all the raw data, and we'll d. | think what we talked about on the phe s before, it had already been proce example, data from one device to make sure it transfers c th orrectly, before ng — is that still the plan? thanks, From: IES (USANYS) (Contractor) Sent: Tuesday, May 12, 2020 10:27 To: TS (SAYS) <a : a - s- Subject: RE: Epstein search warrant documents Hello i. ra list of Me and J just finished our phone call regarding t the all of the data and where the data was collected. | will data. FJ will put fork to send some hard dr ves to GE <0 he can begin to copy the data and send it to us. | will need to figure out a way to get the data off of the hard drives Please let us know if there are any questions. Thank you = rom: TS (S'S) a Sent: Friday, May 8, 2020 2:15 PM 3503-027 Page 8 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002001 EFTA00157183

--=PAGE_BREAK=--

Cc: I (541) TT Subject: RE: Epstein search warrant documents Okay thanks — please do let us know if at any point that changes, otherwise we'll look forward to being able to review the returns in early June. Thanks aga From: a —- Sent: Friday, May 08, 20 g___—_ ee (USANYS) Cc: I (SANs) [Contractor __,-—_._ rr Subject: RE: Epstein search warrant documents There has been talk of us returning to normal soon, so | don't think it will effect the timeline I initially gave you. If it does, I'll let you know. NY CART Coordinator Senior Forensic Examiner cell desk On May 8, 2020 1:58 PM, " (USANYS)" > wrote: h, the info we are thanks—it w! get that list on Thursday Understood, is in the attached mplate ooking fc at the estimate of a month from 5 themsel 4 mentioned r onger like can factor that in? Than omplete transi Jarrant returns you et us know what the current estimate would be — SS (92'S) (USANYS) <a 3503-027 Page 9 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002002 EFTA00157184

--=PAGE_BREAK=--

——_$_ ee FF _ _ iter —-s Subject: RE: Epstein search warrant documents Sorry for the delay, they reduced us to | day a week, so things have been stretched out by a factor of 5. I will be back in the office on Thursday and will be able to get you the list then as I have to access some of our systems to do so. Also, please reach out to me at one of the numbers below so we can brain storm. Thanks. NY CART Coordinator Senior Forensic Examiner cell desk 8, 2020 12:10 PN (USANYS)" > wrote: had said you expected to be able to get us a list of the de Epstein’s residences in N on upon arrest, in about a month (during our conferer f we can still expect that y soon? We're waiting on that list to be able to do an updatec of those devices. Please let us know the current timeline — and also the current nk you and we'd have it a couple oducing the results August and September 0 coordinate on that, and had mentioned you e call, which would be about a month from now. Wan o make sure we're still on Sent: Tuesday, April 07, 2020 15:27 oS USS) a a P (USANYS) a <: SAS — oe -—————_ 7 _ -__ iit, __s Subject: RE: Epstein search warrant documents 3503-027 Page 10 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002003 EFTA00157185

--=PAGE_BREAK=--

trying to get an FBI a larger capacity but | t out when confirmed et’s plan on 11am tomorrow morning, | ar won't know until tomorrow am. | will pus Thanks Sent: Tuesday, April 07, 2020 3:15 PM USNS) i a (2) Subject: RE: Epstein search warrant documents cand od on your end 6 GS EE can also join anytime tomorrow So whenever is ime tomo but only up to six lines at a time — so if FBI has larger capacity so, we can host a confe than that let us know, otherwise I’d propose we do ts to join (and if not, one of I / A) (or: TS < s Sent: Tuesday, April 07 20 14:13 Cc: SE (USANYS) [ [Cont ractor) -; PE (SANs) > a ee < es es (SS) a 2) Subject: RE: Epstein search warrant documents Are you available tomorrow for a conference call to discuss this issue? ss\ iii 3503-027 Page | 1 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002004 EFTA00157186

--=PAGE_BREAK=--

FBI New York (USANYS)" > wrote: orld than what existed Following up on this from a month ago —| know we're living in a differe four weeks ago, but are ssist while working remotely? This has been pending for almost two months and we still don’t have a very basic list of each device or item that was seized or for which of those we've received materials. We're happy to have a call if that and searchec would be useful, but as a first step the most basic thing we're looking for is the info in the template spreadsheet we sent earlier (that’s also attached) thanks, = From: i (USANYS) Sent: Monday, March 09, 2020 12:00 To: a <a i GE (SANS) EE ee -e ees e (SANS) Cc: NE (USANYS) [Contractor] iE (USANYS) ft. [ou ee) Subject: RE: Epstein search warrant documents Unfortur don’t think this is very helpful to us. Did you take a look at the exame preads 1 sent has descriptions that don’t mat 0 the items listed in the the 1Bo0 able to cross-reference. We also can’t tell what you mean by “loose media” without a specific The excel file yc warrant returns (that we sent on 2/23), and we don’t have CART numbers to be comparison to what was seized, we don’t know which items you're referring to as “Windows ¢ machines,” and we can’t tell whether the entirety of any particular item has been transferred, or just partial. For example, it looks like we have gotten very, / few image file: , which is surprising We have also encountered some very significant problems in trying to review the more than 1 million documents we recently received her. So if an - The data we've received has no 0 put any emails and attachments toge email says, “see the attached flight records,” for example, we have no v king that up y with the records thems Not only is that a big problem for us in review, it’s going to be a huge problem for producing the documents to defense counsel. The load file has no link to the native file, so when we load the data to the database, there’s 3503-027 Page 12 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002005 EFTA00157187

--=PAGE_BREAK=--

ay to hav arge to open in the v nvisible to us. ontrol numbers in the load file don’t match up to the native files. So we have two sets of numbers and no way to match up anything—that is, even if we were to try to go hunt down every individual large file in the native files, it would be impossible So the data that we most recently got, we need to get in a form that addresses those issues, and we likely will need to get a similar reproduction of the data we received a couple months a Otherwise we're sifting through more than a million documents without much rhyme or reason I've re-attached the spreadsh sent last week —| think that’s a good place to start in terms of our necessary record o, ar need that info at the very least, as well as anything els you We think would be useful. Also attaching the SW returns for e. And again, we’re happy to meet up anytime and hash all this out in person if that’s useful. thanks, = (om: TT < T Sent: Wednesday, March 04, 2020 16:36 To: ES SANS) a; a PI (USANYS) (USANYS) <a Cc: EE (USAN YS) (Contractor) <j GR (Usanys) ee <> (0S) > eS .)) 2) Subject: RE: Epstein search warrant documents US Att Office for taint Here is a listing of what | have already ha d over in load files to review. Some points of clarification: There were 9 IDE hard drives found in the Manhattan out to be 3 copies of 3d 3( apartment, they turne n total) from a July 20 earch on All the loose media from the NY d. Only 2 Macs one of his properties. | only processed A apartment is included. All th partment are includ from NY and 1 from the Island are included. | will have to more closely coordinate with whoever is loading up Relativity with the remaining Macs as the tool they have to be processed with does not easily re-name the load files Spreadsheet is attached NYO CART Coordinator Senior Fore Examiner 3503-027 Page 13 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002006 EFTA00157188

--=PAGE_BREAK=--

ES (2!) From: IE (USANYS) (cai is Sent: Tuesday, March 03, 2020 12:25 PM (USANYS) — VS a a: (USANYS) i; a (1) (2) <i Subject: RE: Epstein search warrant documents | could do Thursday morning, but | think it would be helpful for us to get the accounting in advance of the meeting so we can figure out in advance what (if any) additional steps we need — is that - ——_$_ Sr FF __ itr s,s Subject: RE: Epstein search warrant documents Can we do Thursday morning? My network should be back by then and I can give you a good accounting. NY CART Coordinator Senior Forensic Examiner cell desk )20 11:15 AM, " On Mar (USANYS)" Doing the weekly check in on this —is there a time this week when everyone can meet on this? thank = From: as Sent: Monday, February (USANYS) 3503-027 Page 14 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002007 EFTA00157189

--=PAGE_BREAK=--

LS <a: I A SAS) > eS SANS) Cc: EE (USANYS) (Contractor) i; PITT (USANYS) SS <0) a 2) <a Subject: RE: Epstein search warrant documents Totally understand about the network issues—we can relate. | do still think it will be helpful to all sit down t er to have an in- n discussion, to make s dy is on the same pa t helpful to facilitate that would with folks available for that next week? And what | think would be m be a spreadsheet of e eparate device referen arch warrant returns been rev columns for whether we've dumped the contents. transferred, what portions were transferred, etc roughly like the attached, with any other categories you think wo = useful — and the ttach hetical, obviously, jus =xamples. That will help us fully wed, transferred, and received so far, and what remains we do want copies of those as well, please including from the discs do an initial sc to make sure no CP, and since | think the ew them as se to be able many thanks, Sent: Monday, February 24, 2020 09:24 O: A (SANS) <a; a (SAYS) — es ee (USANYS) <r Cc: I (USANYS) [Contractor] i: Se (UsAnys) ft. [om eS (2) <a Subject: RE: Epstein search warrant documents Sorry for the delayed response. They are tearing out our old network and giving us a new one, they mandated we delete old stuff (about 400 TB worth). Now that they are working on replacing the network, we can do only local work. I should be able to give you an accounting of what is what. I can say, off the top of my head, that all windows based items from the NY search have been handed over as well as all loose media. The CDs from NY only contained pictures, no documents. There are still some Apple items from NY that need to be produced. As far as the Island stuff goes, the Ist item on your spreadsheet, the "kitchen" mac has been 3503-027 Page 15 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002008 EFTA00157190

--=PAGE_BREAK=--

produced. Still working on the rest. NY CART Coordinator Senior Forensic Examiner cell desk 2020 1 (USANYS)" rote: Team, Following up on the below from last weekend, I’m still not sure how we're addressing this so | es t the same page? We didn’t hear back on which files had previously been provided, but our tech folks thought it would make sense for us to all sc edule a (hopefully relatively brief) meeting to all get on did their best to differentiate, and we got ss to the materials yesterday and its well over a millio what we're Ic vices the ea ng at-1.€., W materials came from, whether it’s full or partial results, how many more devices we have coming, Based on the attached search warrant returns, it looks like from the New York mansion (the PDF) there are approximately 40 devices that would have storage (computers, hard drives, thumb drives, etc.) and that’s not even counting at least 60+ CDs. And then from the Virgin Islands (the Excel spreadsheet), at least more than 25 devices, including multiple servers / server racks So we gotta know what we've already received, what rernains, anticipat edule, , and | know t’s a lot of mo e. The case team will be 2 pieces on all sides so wante loop in eve n Califo nia this coming week from Tuesday through Friday, but then | think generally around the first week of March, which will hopefully be plenty of time to schedule a productive meeting thanks all, From: I (USANYS) Sent: Saturday, February 15, 2020 16:30 To: a <a es (NY) (Fo!) Cc: EEE (USANYS) [Contractor] a ; i a ES (SNS) <a: I (SANS) - FTCtsCtSS Subject: RE: Epstein search warrant documents I’m not sure who’s the exact right person to ask this, so wanted to get everybody on one email chain 3503-027 Page 16 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002009 EFTA00157191

--=PAGE_BREAK=--

about it — | have the hard drive that JJ dropped off that has new Epstein search warrant materials, but it looks like there are also old materials (that | think we had previously received and uploaded??) on the hard drive, and so I’m not sure what’s new. Just generally, and J and | talked about this last week too, but it’s basically impossible for us to keep track of what we’re getting, and what has been completed, without some kind of identification or labeling system, along with a list of which devices have been extracted and downloaded. So for example on the hard drive currently, there are 38 folders labeled “loadFiles” through “37loadFiles” with a modified date of 11/14/19, which | think we may have already previously received — but I’m not sure, because we haven't gotten any info on which folders match up to which devices, etc. And then there’s another folder titled “NYCO24362” that has a modified date of 1/27/20, so | think that may be the materials we hadn't previously received? That folder by itself has more than 600,000 items. | don’t want to give J anything that we've already previously received and uploaded, and | can't tell from the folder or file names whether everything on the drive is new, or whether just additional materials were saved onto it in addition to what we already have. |} are you able to give us some guidance on this? Ultimately what we really need is a spreadsheet of every device, whether it’s been dumped (or partially dumped), and then identifying that same info — which device, and what materials from it — are being given to us with each data transfer. Otherwise | think organizationally and for review purposes it will be a total disaster for us. We're happy to have a meeting on this if that’s helpful — and thanks everybody for the assistance. Assistant U.S. Attorney Southern District of New York 3503-027 Page 17 of 17 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002010 EFTA00157192