From: (NY) (FBI) To: MB (sys) (Contractor) Subject: RE: Epstein search warrant documents Date: Monday, July 13, 2020 9:06:00 AM Attachments: EpsteinNYEvidence, xlsx See attached NYO CART Coordinator Senior Forensic Examiner ES (c!) From: ES, EERE (USANYS) [Contractor] (mailto rs Sent: Monday, July 13, 2020 8:59 AM To: i 0.) (2) Subject: RE: Epstein search warrant documents Hello a. | just got the hard drive and | have some questions about what is on the hard drive. Do you have a moment to talk? Thank you =. From: i 2 (\Y) (e:) a Sent: dnesday, July 8, 2020 12:42 PM To: ER (USANYS) [Contractor] 4 Subject: RE: Epstein search warrant documents Thanks NY CART Coordinator Senior Forensic Examiner cell desk On Jul 8, 2020 12:41 PM," |, ME (USANYS) [Contractor]" > wrote: As soon as | have the hard drive | will reach out to you Thanks 3503-035 Page | of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002093 EFTA00157274

--=PAGE_BREAK=--

From: i a L(Y) () an Sent: dnesday, July 8, 2020 12:38 PM Subject: RE: Epstein search warrant documents Thats what I hear,they are going to get it to you. NY CART Coordinator Senior Forensic Examiner cell desk , | (USANYS) [Contractor]}" > wrote: | am assuming you are sending the data to One Saint Andrews correct? On Jul 8, 2020 12:33 PM," From: i aL (..) 3) Sent: Wednesday, July 8, 2020 12:31 PM Subject: RE: Epstein search warrant documents The drive will begin its journey to you in minutes. Reach out when you get it to go over stuff so you aren't looking at it like a dog looking at a tuba. NY CART Coordinator Senior Forensic Examiner cell desk 2020 5:34 PM, " |, BE (USANYS) [Contractor]" > wrote: On Jul 7, Hello a. r office is not open and | am still working from home. Is it possible to have this data sent to my Thank you. = From: i i.) 3503-035 Page 2 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002094 EFTA00157275

--=PAGE_BREAK=--

Sent: Tuesday, July 7, 2020 5:14 PM Contractor] - —“—tsCi Cc: (S\N'S) a; NIN BY) (81) , a | Dr 29 fm a 8) a a (USANYS) <i Subject: RE: Epstein search warrant documents /ou an actua ns are ready. | will ge T will be R t will be easy to see where the iterns came from. | am a little worried about how the e-mail will Everything with the exception of a couple of ite w eadMe tomorrow number before | send it over. We can send it -mails in present. While looking through on a spot check, the attachments are not connecte e e-mail client they were using to begin with. | know a bit te ouldn’t be too big a | believe it is the for get it right We may have to that we are working e verything ha ause it is a ton y¥ small files. You > far the export is a are getting the whole ball of wax, here, Macs, Windows b: 5, loose media, etc. There will be a few ve and iPad reports, but unsure if | can get you those tomor as they very often take a LONG 1e next day Reach out to me when you get the production so we can correct any night encounter. Thanks —— NYO CART Coordin Senior Forensic Examiner SE (fice ——_ Sent: Tuesday, July 07, 2020 3:42 PM To: i a NY) (Fo) a: a PE (SANs) [Contractor] a CE SUSAN'S) a; a I By) (2%) a SS a PE (USA) a ES) a: a (USANYS) <i Subject: RE: Epstein search warrant documents | understand that some number of the devices are ready to come to us as early as today or 3503-035 Page 3 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002095 EFTA00157276

--=PAGE_BREAK=--

tomorro can figure out who the hard drive s rst instance: s are coming to us in this initial production? 25 —i.e., type of device and which ones, from the spreadsheets 2. What's the total volume of data coming in this round of production? Once we know that, | can let the agents know where the drive needs to go in the first instance thanks, | From: EE ER (Uys) Sent: Tuesday, June 30, 2020 16:23 To: i 88) (FS!) a; a PE (SANS) (Contractor) Cc: (SANS a a IN BY) (8%) Subject: RE: Epstein search warrant documents Checking in for the estimate of when we can expect to get all the USVI materials? thanks, From: ER (sys) Sent: Monday, June 29, 2020 13:00 To: a. ES 0) (FS!) a: (SAYS) (Contractor CE US'S) IN BY) (80) Subject: RE: Epstein search warrant documents Okay thanks — good luck with the cardiologist! And if you can let us know tomorrow that would be great. Thanks again From: i L(Y) -:) a 3503-035 Page 4 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002096 EFTA00157277

--=PAGE_BREAK=--

Sent: Monday, June 29, 2020 12:59 To: I EN (USANYS) (Contractor) qx: EE Cc: A SANS) >: BL) (8) (USANYS) <j Subject: RE: Epstein search warrant documents When I'm in the office tomorrow, I will be better able to estimate. I'm at my cardiologist right now. NY CART Coordinator Senior Forensic Examiner cell desk | ME (USANys)”" > wrote: ugh estimate of wt On Jun 29, 2020 12:56 PM, " Great, thanks. Is there e\ will get the USVI materials? enw estimate of when you’ see how many ite when we'll ge From: ii HL) (3 _____- Sent: Monday, June 29, 2020 12:55 To: I EE (USANYS) (Contractor) yx: EE Cc: i a USANYS) a: a BF (YY) (F 8!) a A SS) a a Subject: RE: Epstein search warrant documents Yep Se NY CART Coordinator Senior Forensic Examiner cell desk On Jun 29, 2020 12:52 PM, " , (USANys)” “ > wrote: y¥, and I’m sorry to ask again, but to make sure, in this production, you’re sending us new versions of what you previo 3503-035 Page 5 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002097 EFTA00157278

--=PAGE_BREAK=--

From: ii BLY) (5) __- Sent: Monday, June 29, 2020 12:50 Co: i EE SANS) a; a By) (FS) (USANYS) <i Subject: RE: Epstein search warrant documents You are getting both NY and USVI. The biggest stumbling block are the newer Mac items that are in APFS (there are a bunch from the Island,) so it is difficult to estimate how long those will take until I see how many items I have to export. NY CART Coordinator Senior Forensic Examiner cell desk On Jun 29, 2020 12:40 PM, " |, ME (Us ANys)" > wrote: larify, a few days to finalize the N y thanks, and just te ork materials, and then what about materials? 1k that is quite a bit more. Just loo! g for an estimated completion date for everything. 2n — does this mean you're giving us a new, complete copy of everything And on my other q from both NY and US thanks, = Sent: Monday, June 29, 2020 12:34 To: i ES (USANYS) (Contractor) a -: (SANS) Cc: (SNS) a IN B(1.Y) (8%) SS, S) A. A (US81%S) a eS) a: a (USANYS) <a Subject: RE: Epstein search warrant documents I am in the process of exporting the materials (documents, spreadsheets, emails, etc) for your review as per my discussions with J. Most of the NY stuff is done, just Mac items left. 3503-035 Page 6 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002098 EFTA00157279

--=PAGE_BREAK=--

This might take a few days as | item in particular has over 500,000 emails. We will be able to provide discovery once Defense Council has provided drives for us to copy items over to. This goes quicker as there is no processing involved. I'll let you know when everything is complete. NY CART Coordinator Senior Forensic Examiner cell desk HE (USANYs)" > wrote: On Jun 29, 2020 11:03 AM, " a Following up on this, | understand from [J that she was a ast week — could you please let us with a 12 TB drive when we will be ab! t the materials? | expect a judge will ask us about discovery as early as this week Also, the related critical question that | don’t think we have clarity on is whether you're giving us a of everything that w: archable), or h materials that you pr collected (including reprod HM figure ongly prefer to just get viously gave outa o cate he prior verything at once ina usable format, but please let us know if you ex, to produce materials differently than that thanks, = From: i i.) 3) |, Sent: Friday, June 19, 2020 13:14 (USANYS) <a Co: A EE USANYS) a: ; a PB (vy) (FS!) a SS) < (Svs) eS) a: ee (USANYS) <x Subject: RE: Epstein search warrant documents We are going every other day now, ramping up to 75% week after next. I need drives to put things on like r | and I discussed earlier. Once | have those drives, it will take me a couple days to copy stuff. LMK when I can expect the drives. Thanks. NY CART Coordinator Senior Forensic Examiner cell desk 3503-035 Page 7 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002099 EFTA00157280

--=PAGE_BREAK=--

On Jun 19, 2020 1:09 PM, _ HE (USANys)" <q > wrote: From: EE ER (Uys) Sent: Wednesday, June 17, 2020 14:28 To: i a (NY) (Fo!) a; PE (SAN YS) [Contractor] SS CS) TT: A (Y) (81) Subject: RE: Epstein search warrant documents From: 7 HL): > Sent: Monday, June 01 1 To: . EE (USANYS) [Contractor] E>; EE Y) (FS) a; a SANS) a; a a BS) (8) Subject: RE: Epstein search warrant documents Will do. NY CART Coordinator Senior Forensic Examiner cell desk On Jun 1, 2020 4:26 PM, "RR. EERE) (UsANys)" 3503-035 Page 8 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002100 EFTA00157281

--=PAGE_BREAK=--

> wrote: and thanks for letting us kn Let’s keep in touch both on timing and also on whether Unders there dentify and categorize what's alre een produced, or if we'll need to just get a the raw data at this stage and go from there. From: i EL) (3) Sent: Monday, June 01, 2020 16:23 To: JE EEE (USANYS) [Contractor] i; a jm (USANYS) <i Co: SL (.Y) FS) a; a a SANS) SS SS) I, MB. () (80 —- Subject: RE: Epstein search warrant documents Unfortunately, recent events and our staffing levels have conspired to put a kink in just about everything. If we can't make heads or tails of the stuff I've already produced, we'll do it again. They have told us that our staffing levels will be steadily increasing over the next few weeks, but I'm going to have to push back my estimate by a week or 2. Sorry about that. My next day in the office is Thursday, so I'll be able to see if I can easily identify what I already gave you and marry it to a reliable identifier. NY CART Coordinator Senior Forensic Examiner cell desk On Jun 1, 2020 4:13 PM, " ME (USANys)" wrote: Thanks for this update — we'll take a look and circle back if any questions. Separately, to follow up on a question from the May 15 email below, the list has just five dev still pending to be transferred to us, and | think it’s right that the plan is to reprodu materials so that we can get them in searchable format, but just wanted to confirm? Currently, we aren’t able to match any of the prior productions to specific devices — so if we’re able to match them up by Bates number now, that might work, but otherwise | think it makes sense for us to get everything. But let us know if any issue with that And related to that question, are we still on track to get the *t think v be able to start reviewing e gotten any updates on that status in the thanks again, 3503-035 Page 9 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002101 EFTA00157282

--=PAGE_BREAK=--

From: Sent: Friday, May 29, 2020 12:53 To Cc: Po Subject: Re: Epstein search warrant documents Updated item descriptions. Just a side note, many thumb drives and SD cards will not have a serial number visible externally, but will report one through our tools. | included those electronically reported serial numbers. Any questions, let me know FBI NY CART Coordinator Senior Examiner Sent: Friday, May 15, 2020 4 >M Subject: RE: Epstein search warrant documents ——= 3503-035 Page 10 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002102 EFTA00157283

--=PAGE_BREAK=--

Here is The listing of all the evidence gathered in NY that | have. | added some columns to guide you to the unique numbers CART NY uses fro their evidence. The template wasn't a slam dunk over, so | did what | could to convey the information. If you are confused by anything, please let me know. In the column for approximate size, it is in GB, totaled at the bottom and converted to TB. In the materials contained column, | put what load file group the data was transferred over in (Mac, Windows, Loose Media, IDE, or Blacklight) If there is no entry in that column, that data has yet to be transferred. There are 2 Macs and a DVR you don't have as well as an iPhone and an iPad. IF the descriptions are a bit light, let me know and I'll do what | can to beef them up. | will get you the Island stuff tomorrow 3503-035 Page 11 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002103 EFTA00157284

--=PAGE_BREAK=--

FBI NY CART Coordinator Senior Examiner From: i, A (S$) <i - Sent: Wednesday, May 13, 2020 12:25 PM To: i A 0. (NY) (°C!) E:T PE (USANYS) [Contractor ee i \ a: a A (S50) ce Subject: RE: Epstein search warrant documents Respectfully, | think there are some miscommunications here — all we have asked is to receive the materials in a format such that we can view them using a system we have access to. We're not t web-enab ask or the material be tran rich be can produce them to defens en an issue. My understanding from | | is that ) to get the original files, which our ss through any FBI tool, so ould put t the files in a format that \ e format so \ edto that in many other cases and it hasn’ the bes em on Relativity, w h we and the a previously way to do it now is just for us (the vendor will process—by which | just mean c e formats that are loadable onto Relat sn't really have anything to do with the taint review—we have to have access to the ery purposes 1s for disc And we were happy to get the materials as they processed, but when we received the 1.1 millio uments earlier t re in a format that wasn’t usable for the | understand from ij that the best stand will be e. That should work for us! | was just trying to understand the approach, as cribed in the email t on Mare sain st get copies of t aterials in their original formats, which | u 1 and designated by d n well as the timeline thanks, From: 7 EL): > ae Tuesday, May 12, 2020 13:03 ES (SS) LS; ca, I (5 cone actor] (- CE SANS) a IN (SAYS) eS) | a es bY) () 3503-035 Page 12 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002104 EFTA00157285

--=PAGE_BREAK=--

Subject: Re: Epstein search warrant documents | Just to be clear. The US Attorney's Office (or it's contractors) are not "processing" anything. You are taking files that | will be extracting from processed evidence and putting them into an E-Discovery tool (Relativity) to do a taint review. Relativity is NOT a forensic tool. It is incapable of dealing with many things that are found forensically on a computer like free space, slack space, and system files to name a few. When we started this, and you insisted you do the taint review in Relativity, | warned you that it was adding months worth of work on top of what was already done, and that Relativity was incapable of viewing everything. You insisted we do it this way. So now J and | have come up with a way to fit this round peg into this square hole. We will get it done. Sorry it has taken so long, but we are talking about terabytes worth of data over multiple forms of digital evidence. Phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers. We have gotten past encryption on multiple devices. When we review devices on such large cases, we usually do it piece by piece as things are processed, | was unaware that you didn't want to review as things were processed, that you wanted to do it "all at once", so that added to the delay. Sorry for that. Just a differentiation of methodology | suppose. HE 2nd | feel confident that the method we have come up with will be more consistent and preserve the attribution of files to devices and links of e-mails to attachments that the load file generation that | did a while back was lacking. FBI NY CART Coordinator Senior Examiner From: i A (AS) <r - Sent: Tuesday, May 12, 2020 11:33 AM To: i (NY) (o) a; a PE (USANYS) [Contractor] Se SCiaG Cc: i A (USANYS) a; a PU SANys) a Subject: RE: Epstein search warrant documents Okay, so just to check, you both think that there is not a need to do a test run? You're both comfortable with just basically sending us copies of everything? | don’t totally understand why we couldn't have done that eight months ago, but regardless of the passage of time, | want to make sure we understand so we can report to our supervisors. | assurne that means that we (at the U.S. Attorney’s Office and through contractors) will therefore need to do all the processing ourselves, 3503-035 Page 13 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002105 EFTA00157286

--=PAGE_BREAK=--

correct? And thanks again to you both from: i BL) |) i _7,- Sent: Tuesday, May 12, 2020 11:30 (USANYS) Cc: SANS) a a, I (SANs) Subject: RE: Epstein search warrant documents Like || said in his earlier email. It will be the raw data and it will be marked so it is easier to attribute it to a particular device. Problem now is how to get the data to [J since he is teleworking. NY CART Coordinator Senior Forensic Examiner cell desk , MR (USANYs)" us what that plan is? Thanks! On May 12, 2020 11:15 AM, " | have no doubt you do, but can you please te From: ii BLY) |) = Sent: Tuesday, May 12, 2020 11:11 To: i EE (USANYS) (Contractor) >; a (USANYS) <i Co: USANYS) a: GR (sys) Subject: RE: Epstein search warrant documents I will use the spreadsheet, no problem. || and I ironed out all the details. We've got a good plan moving forward that will meet your needs. NY CART Coordinator Senior Forensic Examiner ell desk , ME (USANYs)" > wrote: would be very helpful for us if you could ple On May 12, 2020 10:34 AM, " transmitting that info so we make sure we get all the ir > the attached spreadsheet in ed. | think you had previously sent 3503-035 Page 14 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002106 EFTA00157287

--=PAGE_BREAK=--

us a list of certain information that unfortunately wasn’t helpful for us, so we want to make sure we're all on the same page yu just sending a literal copy of all the raw data, and we'll In terms of data transfer, I < process and upload it on our end? | ask to make sure w € any searchability — when FBI sent versio t had already been pro we talked about on the phone a month data from one vake sure it transfers correctly, before sending ove thing — is that still the pla thanks From: E. EE (USANYS) [Contractor] x - Sent: Tuesday, May 12, 2020 10:27 i a (S:\S) es i a.) Subject: RE: Epstein search warrant documents Hello i | finished our phone call regarding the data | will put together a list of data and where the data was c cted. | will work lard drive é can begin to eed to figure out a way to get the data off of the hard drives ) copy the data and send it to us. | w Please let us know if there are any questions Thank you = From: a (S5\YS) <_s Sent: Friday, May 8, 2020 2:15 PM To: a NY) (Fo) a ; a PE (USANys) a (USANYS) <i Cc: EE. EEE (USANYS) [Contractor] >: HE BE (USANYS) > es a (SS) Subject: RE: Epstein search warrant documents Okay thanks — please do let us know if at any point that changes, otherwise we'll look forward t being able to review the returns in early June. Thanks again 3503-035 Page 15 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002107 EFTA00157288

--=PAGE_BREAK=--

From: 7 ELOY) (|) ___- Sent: Friday, May 08, 2020 14:14 oS S\\\) a: a IN (5400s) Cc: EE. EEE (USANYS) (Contractor) x: GE. BE (savy) a SS (S's) , rr > Subject: RE: Epstein search warrant documents There has been talk of us returning to normal soon, so | don't think it will effect the timeline I initially gave you. If it does, I'll let you know. NY CART Coordinator Senior Forensic Examiner cell desk , MR (USANYs)" > wrote: On May 8, 2020 1:58 PM, " Understood, thanks—it w eat to get that list on Thursday. As a refresh, the info we are ooking for is in the attached s' eet template On the returns themsel that the estimate of a month from If so cc longer likely? rthatin? Thanks From: ii BL) |) ___7,- Sent: Friday, May 08, 2020 13:50 1: SS) LT IE (SANs) a a Cc: I (USANYS) (Contractor) <q: BE. GE (Savy) a ee RE °°.) a eS \) 3) Subject: RE: Epstein search warrant documents Sorry for the delay, they reduced us to | day a week, so things have been stretched out by a factor of 5. I will be back in the office on Thursday and will be able to get you the list then as I have to access some of our systems to do so. Also, IL please reach out to me at one of the numbers below so we can brain storm. Thanks. 3503-035 Page 16 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002108 EFTA00157289

--=PAGE_BREAK=--

NY CART Coordinator Senior Forensic Examiner cell desk |, (USANys)" > wrote: On May 8, 2020 12:10 PM, " = Following up on the below, | think you had said you expected to be able to get us a list of the devices seized from the search warrants at Epstein’s residences in New York and the USVI, as well as from his person upon arrest, in abo erence call a month ag to check ct that it a month (during our cor — so wan f we can still ex¢ ? We're waiting on that list to be able to do an updat warrant on all of those de Please let us know the c timeline — and also the current timeline on producing the results from those August and September searches? | think you and J ordinate on th ou had mentioned ta couple 1onths from our call, which would be about a month from now o make sure we’re still on track thanks, Sent: Tuesday, April 07, 2020 15:27 cc: ___$ppasil [Contractor] {i ; i. GE (Usanys) 55) Subject: RE: Epstein search warrant documents Ok let’s plan on 11am tomorrow morning, | am trying ne with a larger capacity but | won't know until tomor Thanks ow am. | will push it out w From: TS EE (USAN\S) (ai ae Tuesday, April 1 2020 3:15 PM —- = —Th (ny) () a (USANYS) <i 3503-035 Page 17 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002109 EFTA00157290

--=PAGE_BREAK=--

SN) a : , (USANYS) <i; a (1) (2) <i Subject: RE: Epstein search warrant documents can do an d on your end ytime tomorrow and (J EJ can also join anytime tomorrow. So whenever is we can host a conference call, but only up to six lines at a time — so if FBI has larger capacity than that let us know, otherwise I'd propose we do moe Ww ou wants to join (and if not, one of I / ED) Sent: Tuesday, April 07, 2020 14:13 1: SS) a a IB (Y) (80) SS a Cc: a I (USANYS) (Cont ractor] hy: ZZ. a SANYS) SO —S?— SO rr a eS (0): <a Subject: RE: Epstein search warrant documents Are you available tomorrow for a conference call to discuss this issue? = s\ iii FBI New York |, ME (USANYs)”" > wrote: On Apr 7, 2020 1:55 PM, " | Following up on this from a month ago —! know we're living in a different world than what existed ou at all able to assist while workin ely? This has been pending for we still don’t have 1 mate or for which of those we've received four w device or item that was seized alm We're happy to have a call if that and ul, but as a first step the most basic thing we’re looking for is the info in the template at’s also attached) 3503-035 Page 18 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002110 EFTA00157291

--=PAGE_BREAK=--

thanks, =. From: I, PE (SANS) Sent: Monday, March 09, 2020 12:00 MM USA) EE EE a a (USANYS) <r Ce: ia. HE (SANS) (Contractor] hii! | | | | (USANYS) | ee es (SS) , er _ i CS Subject: RE: Epstein search warrant documents Unfortunately | don’t think this is very helpful to us. Did you take a look at the example spreadsheet | sent on 2/24? The excel file you sent has descriptions that don’t match up to the items listed in the search warrant returns (that we sent on 2/23), and we don’t have the 1B or CART numbers to be able to cross-reference. We also can’t tell what you mean by “loose media” without a specific comparison to what was seized, we don’t know which items you're referring to as “Windows machines,” and we can’t tell whether the entirety of any particular item has been transferred, or just partial. For exarnple, it looks like we have gotten very, very few image files, which is surprising We have also encountered some very significant problems in trying to review the more than 1 million documents we recently received - The data we've received has no way to put any emails and attachments together. So if an email says, “see the attached flight records,” for example, we have no way of linking that up with the records themselves. Not only is that a big problem for us in review, it’s going to be a huge problem for producing the documents to defense counsel The load file has no link to the native file, so when we load the data to the database, there’s no way to have the native files show up in the database. Because many of the files are too arge to open in the vie , it effectively means that there are many files that are completely nvisible to us. Related, the control numbers in the load file don’t match up to the native files. So we have two sets of numbers and no way to match up anything—that is, even if we were to try to go at down every individual large file in the native files, it would be impossible So the data that we most recently got, we need to get in a form that addresses those issues, and we likely will need to get a similar reproduction of the data we received a couple months ago. Otherwise re sifting through more than a million document without much rhyme or reason. 3503-035 Page 19 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002111 EFTA00157292

--=PAGE_BREAK=--

t last week —! th hat’s a good place to start in terms of and we need that info ery least, as well as an ng els V B uld be use up anytime and hash all t attaching the SW returns re happy to meet tin person if that thanks = rom: i a (.") ) Sent: Wednesday, March 04, 2020 16: To: a a SANS) a; a PN SANS) a ee 2 a a SS Cc: EE ER (USANYS) (Contractor) <>: GE (says) | ee a (SS) eS: SS (.)) (5!) <a Subject: RE: Epstein search warrant documents 6 ie) the US Attorn s Office for taint = is a listing of what | have alreac aints of clarification ound in the Manhattan search on apartment, they tu out to be 3 cor of 3 ves ( ves in total) from a July one of his properties. | only processed 3 they were all cor the loose media from the NY apartment is included. All the Windows machines from the NY apartment are included. Only 2 Macs from NY and 1 from the Island are included | will have to more closely coordinate with w er is loading up Relativity with the remaining Macs as the tool they have to b with does not easily re-name the load files Spreadsheet is attached Sent: Tuesday, March 03, 2020 12 25 PM To: i aL (\\) (5S) a: a BR (USANys) a a a a (USANYS) <i Cc: EE (USANYS) (Contractor) rs; i Mm (USANYS) a ; rs; i Se (USANYS) a; ES (Ny) (S|) <i Subject: RE: Epstein search warrant documents 3503-035 Page 20 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002112 EFTA00157293

--=PAGE_BREAK=--

| could do Thursday morning, but | think it would be helpful for us to get the accounting in advance of the meeting so we can figure out in advance what (if any) additional steps we need —is that ro: PE SAN : S) a eS a a (USANYS) <i Cc: SS) [Contractor] < a Zz — YS) a a .\) |) Subject: RE: Epstein search warrant documents Can we do Thursday morning? My network should be back by then and I can give you a good accounting. NY CART Coordinator Senior Forensic Examiner cell desk On Mar 2, 2020 11:15 AM, " | (USANYs)" > wrote: y check in on this —is there a time this n meet on this? Doing the wee thanks, From: (Sys) Sent: Monday, February 24, 2020 17:38 Cc: EE ER (USANYS) (Contractor) <a: BE. BE (USA) i SStmr?CSCérS—SS a ee) | Subject: RE: Epstein search warrant documents Totally understand about the network issues—we can relate still think it will be helpful to all sit ussion, to make su erybody is on the sarne page 3503-035 Page 21 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002113 EFTA00157294

--=PAGE_BREAK=--

folks available for that next week? And what | think would be most helpful to facilitate that would n the tw columns for whether we’ve dumped the contents, whether they've been reviewed and/or search warrant returns, with be a spreadsheet of each separate device referenced transferred, what portions were transferred, etc Something roughly like the attached, with any other categories you think would be useful — and the nfo on the attached is mos pothetical, obviously, just as examples. That will help us fully understand what's been reviewed, transferred, and received so far, and what remains. {Also just on the pictures, we do want copies of those as well, please including from the discs and the device an an initial screen to make sure no CP, and since | think the —| think FBI was going no, we'll need to get those to be able to review them as well.) many thanks, From: 7 EL): —____- Sent: Monday, February 24, 2020 09:24 To: (SS) a: a PT! (US40NS) 2) a a ‘TT Cc: I. EE (USANYS) [Contractor] <x: HE (Uv) oa —SMSésdSC SC Subject: RE: Epstein search warrant documents Sorry for the delayed response. They are tearing out our old network and giving us a new one, they mandated we delete old stuff (about 400 TB worth). Now that they are working on replacing the network, we can do only local work. I should be able to give you an accounting of what is what. I can say, off the top of my head, that all windows based items from the NY search have been handed over as well as all loose media. The CDs from NY only contained pictures, no documents. There are still some Apple items from NY that need to be produced. As far as the Island stuff goes, the Ist item on your spreadsheet, the "kitchen" mac has been produced. Still working on the rest. NY CART Coordinator Senior Forensic Examiner cell desk On Feb 23, 2020 12:21 AM," |, (USANYS)" > wrote: Team, Following up on the below from last weekend, I’m still not sure how we're addressing this so | 3503-035 Page 22 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002114 EFTA00157295

--=PAGE_BREAK=--

thought it would make sense for us to all schedule a (hopefully relatively brief) meeting to all get on the same page? We didn’t hear back on which files had previously been provided, but our tech folks did their best to differentiate, and we got access to the materials yesterday and its well over a million documents, and we don’t have any idea what we’re looking at —i.e., which devices the materials came from, whether it’s full or partial results, how many more devices we have coming, etc. Based on the attached search warrant returns, it looks like from the New York mansion (the PDF) there are approximately 40 devices that would have storage (computers, hard drives, thumb drives, etc.) and that’s not even counting at least 60+ CDs. And then from the Virgin Islands (the Excel spreadsheet), at least more than 25 devices, including multiple servers / server racks. So we gotta know what we've already received, what remains, anticipated schedule, etc, and | know it’s a lot of moving pieces on all sides so wanted to loop in everybody at once. The case team will be in California this coming week from Tuesday through Friday, but then | think generally around the first week of March, which will hopefully be plenty of time to schedule a productive meeting. thanks all, From: i, MN (USANYS) Sent: Saturday, February 15, 2020 16:30 To: i (NY) (5S) a; TD (iy) (F5!) a Cc: EE EE (USANYS) (Contractor) >; J SS SS) a: a Pe (SANs) FTC Subject: RE: Epstein search warrant documents I'm not sure who's the exact right person to ask this, so wanted to get everybody on one email chain about it —! have the hard drive that [Jj dropped off that has new Epstein search warrant materials, but it looks like there are also old materials (that | think we had previously received and uploaded??) on the hard drive, and so I’m not sure what’s new. Just generally, and [J and | talked about this last week too, but it’s basically impossible for us to keep track of what we’re getting, and what has been completed, without some kind of identification or labeling system, along with a list of which devices have been extracted and downloaded. So for example on the hard drive currently, there are 38 folders labeled “loadFiles” through “37loadFiles” with a modified date of 11/14/19, which | think we may have already previously received — but I’m not sure, because we haven’t gotten any info on which folders match up to which devices, etc. And then there’s another folder titled “NYCO24362” that has a modified date of 3503-035 Page 23 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002115 EFTA00157296

--=PAGE_BREAK=--

1/27/20, so | think that may be the materials we hadn't previously received? That folder by itself has more than 600,000 items. | don’t want to give J anything that we've already previously received and uploaded, and | can’t tell from the folder or file names whether everything on the drive is new, or whether just additional materials were saved onto it in addition to what we already have. [Mp are you able to give us some guidance on this? Ultimately what we really need is a spreadsheet of every device, whether it’s been dumped (or partially dumped), and then identifying that same info — which device, and what materials from it — are being given to us with each data transfer. Otherwise | think organizationally and for review purposes it will be a total disaster for us. We're happy to have a meeting on this if that’s helpful — and thanks everybody for the assistance. Assistant U.S. Attorney Southern District of New York 3503-035 Page 24 of 24 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002116 EFTA00157297