From: Po To: Cts Subject: RE: Epstein search warrant documents Date: Friday, June 19, 2020 2:06:42 PM Ok HE. Thanks. The case squad wants to have a meeting about this so I'll let you know what is what when the dust settles. NY CART Coordinator Senior Forensic Examiner cell desk On Jun 19, 2020 1:36 PM," “ > wrote: Hello 7’. nt | can have the drives shipped to you or if you want you can come and pick up the drives vould be Monday — Friday. Please let me know which you prefer am-1 able for you to meet up with between Andrews. Someone Thank you Sent: Friday, June 19, 2020 1:14 PM EE OO ___OOeeeee——s Subject: RE: Epstein search warrant documents We are going every other day now, ramping up to 75% week after next. I need drives to put things on like r | and I discussed earlier. Once | have those drives, it will take me a couple days to copy stuff. LMK when I can expect the drives. Thanks. NY CART Coordinator Senior Forensic Examiner cell desk On Jun 19, 2020 1:09 PM, "EY (UsANys)" 3503-029 Page | of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002029 EFTA00157211

--=PAGE_BREAK=--

ew rot: Sent: Wednesday, June 17, 2 oO o Sent: Monday, June 01, 2020 16:28 (USANYS) <i cy inl Subject: RE: Epstein search warrant documents = = a NY CART Coordinator Senior Forensic Examiner cell desk On Jun 1, 2020 4:26 PM, " (USANYS)" “ > wrote: , and thanks for letting us know. Let’s keep in touch both on timing and also on whether Understoc 3503-029 Page 2 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002030 EFTA00157212

--=PAGE_BREAK=--

there’s a way to identify and categorize what's already been produced, or if we'll need to just get a the raw data at this stage and go from there Sent: Monday, June 01, 2020 16:23 (USANYS) <i ee PS Subject: RE: Epstein search warrant documents Unfortunately, recent events and our staffing levels have conspired to put a kink in just about everything. If we can't make heads or tails of the stuff I've already produced, we'll do it again. They have told us that our staffing levels will be steadily increasing over the next few weeks, but I'm going to have to push back my estimate by a week or 2. Sorry about that. My next day in the office is Thursday, so I'll be able to see if I can easily identify what I already gave you and marry it to a reliable identifier. NY CART Coordinator Senior Forensic Examiner cell desk On Jun 1, 2020 4:13 P (USANYS)" Thanks for this update — we'll take a look and circle back if any questions Separately, to follow up on a question from the May 15 email below, the list has just five devices as still pending to be transferred to us, and | think it’s right that the plan is to reproduce all the materials so that we can get them in searchable format, but just wanted to confirm? Currently, we aren't able to match an the prior productions to specific devices — so if we’re able to match them up by Bates number n that might work, but otherwise | think it makes sense for us to get everything. But let us know if any issue with that And related to that question, are we still on track to get the full ra of data in the next week or yt think v g e able to start reviewing otten any updates on that status in the past few weeks, and we’re eager to thanks again, 3503-029 Page 3 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002031 EFTA00157213

--=PAGE_BREAK=--

Fro: Sent: Friday, May 29, 2020 12:53 Ce: Subject: Re: Epstein search warrant documents Updated item descriptions. Just a side note, many thumb driv nd SD cards will not have a serial number visible externally, but will report one through our tools, | included those electronically reported serial numbers. Any questions, let me know FBI NY CART Coordinator Subject: RE: Epstein search warrant documents 3503-029 Page 4 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002032 EFTA00157214

--=PAGE_BREAK=--

Subject: Re: Epstein search warrant Here is The listing of all the evidence gathered in NY that | have. | added some columns to guide you to the unique numbers CART NY uses fro their evidence. The template wasn't a slam dunk over, so | did what | could to convey the information. If you are confused by anything, please let me know. In the column for approximate size, it is in GB, totaled at the bottom and converted to TB. In the materials contained column, | put what load file group the data was transferred over in (Mac, Windows se Media, IDE, or Blacklight) If there is no entry in that column, that data has yet to be transferred. There are 2 Macs and a DVR you don't have well as an iPhone and an iPad. IF the descriptions are a bit light, let me know and I'll do whe can to beef them up. | will get you the Island stuff tomorrow FBI NY CART Coordinator 3503-029 Page 5 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002033 EFTA00157215

--=PAGE_BREAK=--

Senior Examiner Sent: Wednesday, May 13, 2020 12:25 PM Ce: Subject: RE: Epstein search warrant documents Respectfully, | think there are some miscommunications here — a dis to receive the e have as \ materials in a format such that we them using a an view yst ave access to 10t able y FBI tool, so we asked for the materials We're requirec have the files in a format that we can produce them to defense cour My und tanding from || 5 that riginal files that in many other cases and it hasn’t previously s just for us (the ch | just mean co n't really have 1s for discovery purposes And we were happy to get the materia t when we received the 1.1 millio ments earlier this year, t able for the reasons 1, |understand from Jj that the best w et copies of the materials in their original formats, which | understand will be segregated That should work wasnt us NM Viar scribed in the email | sent on y forward s to just and designated by rus! | was just trying to understand the approach, as well as the timeline Sent: Tuesday, May 12, 2020 13:03 Subject: Re: Epstein search warrant documents 3503-029 Page 6 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002034 EFTA00157216

--=PAGE_BREAK=--

Just to be clear. The US Attorney's Office (or it's contractors) are not "processing" anything. You are taking files that | will be extracting from processed evidence and putting them into an E-Discovery tool (Relativity) to do a taint review. Relativity is NOT a forensic tool. It is incapable of dealing with many things that are found forensically on a computer like free space, slack space, and system files to name a few. When we started this, and you insisted you do the taint review in Relativity, | warned you that it was adding months worth of work on top of what was already done, and that Relativity was incapable of viewing everything. You insisted we do it this way. So now [and | have come up with a way to fit this round peg into this square hole. We will get it done. Sorry it has taken so long, but we are talking about terabytes worth of data over multiple forms of digital evidence. Phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers. We have gotten past encryption on multiple devices. When we review devices on such large cases, we usually do it piece by piece as things are processed, | was unaware that you didn't want to review as things were processed, that you wanted to do it "all at once", so that added to the delay. Sorry for that. Just a differentiation of methodology | suppose. HMM and | feel confident that the method we have come up with will be more consistent and preserve the attribution of files to devices and links of e-mails to attachments that the load file generation that | did a while back was lacking. FBI NY CART Coordinator Senior Examiner From: aS (SAS) <i Sent: Tuesday, May 12, 2020 11:33 AM Co: TS |< >; | Se documents Okay, so just to check, you both think that there is not a need to do a test run? You're both comfortable with just basically sending us copies of everything? | don’t totally understand why we couldn’t have done that eight months ago, but regardless of the passage of time, | want to make sure we understand so we can report to our supervisors. | assurne that means that we (at the U.S. HER Office and through contractors) will therefore need to do all the processing ourselves, correct? And thanks again to you both 3503-029 Page 7 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002035 EFTA00157217

--=PAGE_BREAK=--

Sent: Tuesday, May 12, 2020 11:30 Subject: RE: Epstein search warrant documents Like J said in his earlier email. It will be the raw data and it will be marked so it is easier to attribute it to a particular device. Problem now is how to get the data to | | since he is teleworking. NY CART Coordinator Senior Forensic Examiner cell desk On May 12, 2020 11:15 AM, "| (USANYS)" P > wrote: have no doubt you do, but can you please tell us what that plan is? Thanks! Sent: Tuesday, May 12, 2020 11:11 Ce: Subject: RE: Epstein search warrant documents I will use the spreadsheet, no problem. J and I ironed out all the details. We've got a good plan moving forward that will meet your needs. NY CART Coordinator Senior Forensic Examiner cell desk On May 12, 2020 10:34 AM, "| (USANYS)" > wrote: GE, it would be very helpful for us if you could please transmitting that info so we make sure we get all the inf é the attached spreadsheet in reed. | think you had previously sent us a list of certain information that unfortunately wasn’t helpful for us, so we want to make sure e€ all on the same page 3503-029 Page 8 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002036 EFTA00157218

--=PAGE_BREAK=--

In terms of data trar st sending a literal cc of all the raw data, and we'll pro sent v ss and dit on our end? € any searchability — when FBI , it had alre t we talked about on the phone a ons e sure it transfers correctly, before r example, data month ago was getting, sending over literally everything — is that st thanks Sent: Tuesday, May 1 0 10:27 Subject: RE: Epstein search warrant documents Hello ut together a list of ust finished our phone call regarding the data | will f ed. | will work to s Me and J the all of the data and where the data was c | so he can begin to copy the data and send it to us. | will need to figure out a way to get the data off of the hard drives arives to some Please let us know if there are any questions Thank you Sent: Friday, May 8, 2020 2:15 PM us know if at any point that changes, otherwise we'll look forward to w the returns in early June. Thanks again 3503-029 Page 9 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002037 EFTA00157219

--=PAGE_BREAK=--

Sent: Friday, May 08, 2020 14:14 +4 Subject: RE: Epstein search warrant documents There has been talk of us returning to normal soon, so | don't think it will effect the timeline I initially gave you. If it does, I'll let you know. NY CART Coordinator Senior Forensic Examiner cell desk 8, 2020 1:58 PM, " (USANYS)" On May “ > wrote: 3et that list on Thursday. As a refresh, the info we are turns thems plete trans et us know what the curre Subject: RE: Epstein search warrant documents Sorry for the delay, they reduced us to | day a week, so things have been stretched out by a factor of 5. I will be back in the office on Thursday and will be able to get you the list then as I have to access some of our systems to do so. Also, [BB please reach out to me at one of the numbers below so we can brain storm. Thanks. 3503-029 Page 10 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002038 EFTA00157220

--=PAGE_BREAK=--

NY CART Coordinator Senior Forensic Examiner cell desk §, 2020 12:10 PM, " (USANYS)" > wrote: spon arrest, in about a montt uring our conferenc f we can still expect that oon? We're waiting on that list ble to do an updated search Please let us k t timeline — and also tk nose August and § u had mentio Subject: RE: Epstein search warrant documents on 11am tomorrow morning, | am trying tc an FBI line with a larger capacity but | ow until tomorrow am. | will push it out when confirmed Sent: Tuesday, April 07, 2020 3:15 PM 3503-029 Page 11 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002039 EFTA00157221

--=PAGE_BREAK=--

Subject: RE: Epstein search warrant documents So wheneve Yes, | can do anytime tomorrow, and [ij J can also join anytime tomor end Also, we can host a conference call, but only up to six lines at a time — so if FBI has larger capacity than that let us know, otherwise I’d propose we do ants to join (and if not, one of Jy / i) sre Tuesday, April 07, 2020 14:13 Co: rs >; ee SS) <a (USANYS) <a eS a BR (SANS) Subject: RE: Epstein search warrant documents Are you available tomorrow for a conference call to discuss this issue? FBI New York On Apr 7, 2020 1:55 PM," (USANYS)" > wrote: Fo four weeks ago, but are you at all able to assist while working remotely? This has been pending for 1g up on this from a month ago —! know we're living in a different world than what existed Sic list o ce or item that was seized iths and we still don’t have a r for which of those we've received materials e’re happy to have a call if that but as a first dsheet we sent earlier (that’s also attached) would be tep the most basic thing we’re looking for is the info in the template spre 3503-029 Page 12 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002040 EFTA00157222

--=PAGE_BREAK=--

thanks, = From: iS (USANYS) Sent: Monday, March 09, 2020 12:00 oS <a ; | ee >; (USANYS) <a LS <a i BE (SANS) _ @sefe o |. Jom EE Subject: RE: Epstein search warrant documents search warrant returns ), and we don’t have the 1B or CART numbers to be able to cross-reference. We also can’t tell v you mean by “loose media” without a specific efe comparison to what was seized, we don’t know which items you're referring to as “Windows machines,” and we can’t tell whether the entirety of any particular item has been transferred, or just partial. For example, it looks like we have gotten very, very few image files, which is surprising. We have also encountered some v: significant problems in trying to review the more than 1 million documents we recently received Th email says, ved has no way to put any emails and attachments together. So if an see the attached flight records,” for example, we have no way of linking that up with the records themselves. Not only is that a big problem for us in review, it’s going to be a huge problem for producing the documents to defense counsel The load file has no link to the native file, so when we load the data to the database, there’s no way to have the native files show up in the database. Because many of the files are too arge to open in the viewer, it effec vely means that there are many files that are completely nvisible to us. - Related, the control numbers in the load file don’t match up to the native files. So we have two sets of numbers and no way to match up anything—that is, even if we were to try to go f hunt down every individual large file in the native files, it would be impossible So the data that we most recently got, we need to get in a form that address ssues, and we likely will need to get a similar reproduction of the data we received a couple months ago. Otherwise we're sifting through more than a million documents without much rhyme or reason I've re-attached the spreadsheet we sent last week — | think that’s a good place to start in terms of 3503-029 Page 13 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002041 EFTA00157223

--=PAGE_BREAK=--

our necessi we need that ir ng else you ping, a 9 attaching the »py to meet thanks, Sent: Wed y, March 04, 2020 16:36 oS (SAS) <a; Se (USANYS) <a Subject: RE: Epstein search warrant documents rin load f the US Attorney's Office for taint DE hard driv s a listing of what | have already ints of clarification: Ther out to be 3 Manhattan s found int in total) from a July 200 All the apartment is included. All the Windows machines from the NY apartment are included. Only 2 Macs one of his properties. | only proce se media from the NY from NY and 1 from the Island are included | will have to more closely coordinate with whoever is loading up Relativity with the remaining Macs as the tool they have t ocessed with does not easily re-name the load files Spreadsheet is attached NYO CART Coordinator Senior Forensi aminer Sent: Tuesday, March 03, 2020 12:25 PM (USNS) ee 9 —————————_— — ___ Subject: RE: Epstein search warrant documents 3503-029 Page 14 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002042 EFTA00157224

--=PAGE_BREAK=--

| could do of the meeting so we can figure out in ad Thursday morning, but | think it would be helpful for o get the accountin shat (if any) additional ste we need — is that possible? Sent: Tuesday, March 03, 2020 09:59 Subject: RE: Epstein search warrant documents Can we do Thursday morning? My network should be back by then and I can give you a good accounting. NY CART Coordinator Senior Forensic Examiner cell desk On Mar 2, 2020 11:15 AM, " an meet on this? Subject: RE: Epstein search warrant documents ME (USANys) USANYS) Totally understand about the network issues—we can relate. | do still think it will be helpful to all sit down n discussion, to make sur folks a »gether to have an in- erybady is on the same page vailable for that next And what | think would be most helpful to facilitate that w 3503-029 Page 15 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002043 EFTA00157225

--=PAGE_BREAK=--

be a spreadsheet of each separate device referen columns for whether we’ve dumped the contents, v transferred, what portions were transferred, etc Something roughly like the attached, with any other categories you think would be useful — and th nfoont ttach ostly hypothetical, obviously, just as examples. That will help us fully understand what’s been reviewed, transferred, and received so far, and what remains {Also just on the pictu ve do want copies of those as well, please including from the discs and jo an initial screen to make sure no CP, and since | think the the devices —| think FBI was goin, answer was no, we'll need to get those to be able to review them as well.) many thanks, = Sent: Monday, February 24, 2020 09:24 (SNS) ee ‘\\) LS <a: a. BE SANS) _ @t.e 9. too Subject: RE: Epstein search warrant documents =. Sorry for the delayed response. They are tearing out our old network and giving us a new one, they mandated we delete old stuff (about 400 TB worth). Now that they are working on replacing the network, we can do only local work. I should be able to give you an accounting of what is what. I can say, off the top of my head, that all windows based items from the NY search have been handed over as well as all loose media. The CDs from NY only contained pictures, no documents. There are still some Apple items from NY that need to be produced. As far as the Island stuff goes, the Ist item on your spreadsheet, the "kitchen" mac has been produced. Still working on the rest. NY CART Coordinator Senior Forensic Examiner cell desk On Feb 23, 2020 1 (USANYS)" Team, Following up on tt ow from last weekend, I’m still not sure how we're ad ng this so | thought it would rm us to all schedule a (hopefully relatively brief) meeting to all get on 3503-029 Page 16 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002044 EFTA00157226

--=PAGE_BREAK=--

the same page? We didn’t hear back on which files had previously been provided, but our tech folks did their best to differentiate, and we got access to the materials yesterday and its well over a million documents, and we don’t have any idea what we're looking at —i.e., which devices the materials came from, whether it’s full or partial results, how many more devices we have coming, etc Based on the attached search warrant returns, it looks like from the New York mansion (the PDF) there are approximately 40 devices that would have storage (computers, hard drives, thumb drives, etc.) and that’s not even counting at least 60+ CDs. And then from the Virgin Islands (the Excel spreadsheet), at least more than 25 devices, including multiple servers / server racks. So we gotta know what we've already received, what remains, anticipated schedule, etc, and | know it’s a lot of moving pieces on all sides so wanted to loop in everybody at once. The case team will be in California this coming week from Tuesday through Friday, but then | think generally around the first week of March, which will hopefully be plenty of time to schedule a productive meeting. thanks all, From: NE (USANYS) Sent: Saturday, February 15, 2020 16:30 TO: eS <> ee a CSCS Ged a SS) <> a (S45) FCC Subject: RE: Epstein search warrant documents I'm not sure who's the exact right person to ask this, so wanted to get everybody on one email chain about it —! have the hard drive that dropped off that has new Epstein search warrant materials, but it looks like there are also old materials (that | think we had previously received and uploaded??) on the hard drive, and so I’m not sure what's new. Just generally, and | | and | talked about this last week too, but it’s basically impossible for us to keep track of what we're getting, and what has been completed, without some kind of identification or labeling system, along with a list of which devices have been extracted and downloaded. So for example on the hard drive currently, there are 38 folders labeled “loadFiles” through “37loadFiles” with a modified date of 11/14/19, which | think we may have already previously received — but I’m not sure, because we haven’t gotten any info on which folders match up to which devices, etc. And then there’s another folder titled “NYCO24362” that has a modified date of 1/27/20, so | think that may be the materials we hadn't previously received? That folder by itself has 3503-029 Page 17 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002045 EFTA00157227

--=PAGE_BREAK=--

more than 600,000 items. | don’t want to give J anything that we've already previously received and uploaded, and | can't tell from the folder or file names whether everything on the drive is new, or whether just additional materials were saved onto it in addition to what we already have. | are you able to give us some guidance on this? Ultimately what we really need is a spreadsheet of every device, whether it’s been dumped (or partially dumped), and then identifying that same info — which device, and what materials from it — are being given to us with each data transfer. Otherwise | think organizationally and for review purposes it will be a total disaster for us. We're happy to have a meeting on this if that’s helpful — and thanks everybody for the assistance. Assistant U.S. Attorney Southern District of New York 3503-029 Page 18 of 18 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002046 EFTA00157228