From: (NY) (FBI) To: MR BR (SNS) (Contractor); I I CUsanys) Subject: RE: Epstein search warrant documents Date: Tuesday, July 14, 2020 1:31:00 PM Cool NY CART Coordinator Senior Forensic Examiner cell desk On Jul 14, 2020 12:19 PM, " |, ME (USANys)" > wrote: Great, thanks — let's plan to chat at 1:00 tomorrow, and I'll send a dial-in shortly. Thanks again From: i BL.) (5 ___- Sent: Tuesday, July 14, 2020 12:02 To: I ER (USANYS) (Contractor) xy: EE (USANYS) <i i...) SS CS) | (8) (51) Subject: RE: Epstein search warrant documents I'll fill it out and get it back to you ASAP. | am available tomorrow from 7:30 AM till about 3:30 PM, just let me know when. NY CART Coordinator Senior Forensic Examiner cell desk |, MY (USANys)" On Jul 14, 2020 11:58 AM, " 4 > wrote: We've received and reviewed the hard drive you provided last week. Unfortunately it’s still not ces have been fully 100% included in that drive? We're ne ble for us to determin able to tell based on looking at the cont own folders which dev s not reflect The at have been fully transferred. Could you please fill in the tw one you included on the drive, but it ¢ preads columns I've added, L and M, indicating 3503-042 Page | of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002167 EFTA00157347

--=PAGE_BREAK=--

which devices have been fully transferred to us, and for the ones that are not fully transferred, the estimated time for completion? If you could please let us know that today it will be extremely helpful in figuring out how to proceed. And separately, could you please let me know what times you’re available for a call tomorrow? It would be helpful to discuss why a number of the devices were combined together in folders on the drive, rather than being provided separately. And also helpful to know how long it would take to correct that. thanks very much, From: TE MEE (USANYS) Sent: Wednesday, May 13, 2020 12:25 To: L.A (UsANYs) (Contractor as Ci SS) a: IN (USAKYS) a SS a |’) oe _ Subject: RE: Epstein search warrant documents Respectfully, | think there are some miscommunications here — all we have asked is to receive the materials in a format such that we can view them using a system we have access to. We're not able to get web-enabled access through any FBI tool, so we asked for the materials to be transferred in a oadable format so we could put therm on Relativity, which both we and the agents can access. We're required to have the files in a format that we can produce them to defense counsel. I've done that in many other cases and it hasn’t previously been an issue. My understanding from || is that the best way to do it now is just for us (the U.S. Attorney’s Office) to get the original files, which our vendor will process—by which | just mean converting into file formats that are loadable onto Relativity. It doesn’t really have anything to do with the taint review—we have to have access to the docs in our systems for discovery purposes And we were happy to get the materials as they were processed, but when we received the 1.1 million documents earlier this year, they were in a format that wasn’t usable for the reasons described in the email | sent on March 9. Again, | understand from [i that the best way forward s to just get copies of the materials in their original formats, which | understand will be segregated and designated by device. That should work for us! | was just trying to understand the approach, as well as the timeline thanks, 3503-042 Page 2 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002168 EFTA00157348

--=PAGE_BREAK=--

From: i L(Y) (e:) Sent: Tuesday, May 12, 2020 13:03 oS SS) a; a IN (USNs) [Contractor] (i> Ce: SNS a a PI (USAYS) eo | oor o fF ii (Fe) Subject: Re: Epstein search warrant documents i. Just to be clear. The US Attorney's Office (or it's contractors) are not "processing" anything. You are taking files that | will be extracting from processed evidence and putting them into an E-Discovery tool (Relativity) to do a taint review. Relativity is NOT a forensic tool. It is incapable of dealing with many things that are found forensically on a computer like free space, slack space, and system files to name a few. When we started this, and you insisted you do the taint review in Relativity, | warned you that it was adding months worth of work on top of what was already done, and that Relativity was incapable of viewing everything. You insisted we do it this way. So now [J and | have come up with a way to fit this round peg into this square hole. We will get it done. Sorry it has taken so long, but we are talking about terabytes worth of data over multiple forms of digital evidence. Phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers. We have gotten past encryption on multiple devices. When we review devices on such large cases, we usually do it piece by piece as things are processed, | was unaware that you didn't want to review as things were processed, that you wanted to do it "all at once", so that added to the delay. Sorry for that. Just a differentiation of methodology | suppose. HM 2nd | feel confident that the method we have come up with will be more consistent and preserve the attribution of files to devices and links of e-mails to attachments that the load file generation that | did a while back was lacking. FBI N¥ CART Coordinator Senior Examiner From: ES (US5\S) <r Sent: Tuesday, May 12, 2020 11:33 AM To: i (NY) (5S!) a; a PE (USANYS) [Contractor] SCS 3503-042 Page 3 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002169 EFTA00157349

--=PAGE_BREAK=--

Ci UNS) a I SANS) Subject: RE: Epstein search warrant documents Okay, so just to check, you both think that there is not a need to do a test run? You're both r able with just basically of everything? | don’t totally understand why we ardless of the passage of time, | want to make stand so w n report to our supervisors. | assume that means that we (at the e and through contractors) will therefore need to do all the processing ourselves And thanks again to you both From: ii BLY) —____z- Sent: Tuesday, May 12, 2020 11:30 To: BD ER (SAN YS) (Contractor) yy: i (USANYS) <r Co: i A USANYS) a: a PE USANYS) Subject: RE: Epstein search warrant documents Like | | said in his earlier email. It will be the raw data and it will be marked so it is easier to attribute it to a particular device. Problem now is how to get the data to [J since he is teleworking. NY CART Coordinator Senior Forensic Examiner cell desk On May 12, 2020 11:15 A , ME (USANYsS)" > wrote: you do, but can you please tell us what that plan is? Thanks! | have no dou From: ii BLY) Sent: Tuesday, May 12, 2020 11:11 To: i ER (USANYS) (Contractor) yy: i i (USANYS) <_s Ce: (SS) a: a I USANYS) Subject: RE: Epstein search warrant documents I will use the spreadsheet, no problem. J and I ironed out all the details. We've got a good plan moving forward that will meet your needs. 3503-042 Page 4 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002170 EFTA00157350

--=PAGE_BREAK=--

NY CART Coordinator Senior Forensic Examiner cell desk | BE (USANYs)" > wrote: HE, it would be very helpful for us if you could please u transmitting that info so we make s On May 12, 2020 10:34 AM, " etin he attached spread eed th nk ul for us, e get all the in u had previously sent us a list of certain information that unfortunately wasn’t h © we want to make sure we’re all on the same page. In terms of data transfer, JJ are you just sending a literal copy of all the raw data, and we'll ss and upload it on our end? | ask to make sure we don’t lose any searchability — when FBI versions before, it had already been pro ed. | think what we talked about on the pho petting, for example, data fro > device to make sure it transfers z—ist month ago was 10 t r literally everyth at still the plan? From: . EE (USANYS) [Contractor] <x > Sent: Tuesday, May 12, 2020 10:27 i (SS) Ci Subject: RE: Epstein search warrant documents Hello ZZ. =r a list of Me and J just finished our phone call regarding the the all of the data and data off of the hard drives Jata. FE will put to where the data was collected. | will work to send some hard driv he can begin to copy the data and send it to us. | will need to figure out a way to get the § to Please let us know if there are any questions Thank you. = From: a a SANS) <a - Sent: Friday, May 8, 2020 2:15 PM I (USA) 3503-042 Page 5 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002171 EFTA00157351

--=PAGE_BREAK=--

(USA it USANYS) {Con <1) A RR (USANY) a |): Subject: RE: Epstein search warrant documents Okay thanks — please do let us know if at any point that changes, otherwise we'll look forward to being able to review the returns in early June. Thanks a rom i "3 sere Frid NV 2 a ee | (NY) (FC!) a; , Cc: ee USANYS) KContractor} i= | | _— a 3) Subject: RE: Epstein search warrant documents There has been talk of us returning to normal soon, so | don't think it will effect the timeline I initially gave you. If it does, I'll let you know. NY CART Coordinator Senior Forensic Examiner cell desk |, MR (USANYs)" > wrote: On May 8, 2020 1:58 PM, " thanks—it will be grea get that list on Thursday. As a refresh looking for is in the attached spreac t template On the returns the > the cha ed mean that the estimate of a month from now for complete transm »f the search warrant returns is no longer likely? If so could you please let us Know what the current estimate would be, so we can factor that in? Thanks very much N's) a a I (520%) 2 tT fF 7; | (USANYS) <r Cc: EE ER (USANYS) (Contractor) <q; GE (sas) 3503-042 Page 6 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002172 EFTA00157352

--=PAGE_BREAK=--

Subject: RE: Epstein search warrant documents Sorry for the delay, they reduced us to | day a week, so things have been stretched out by a factor of 5. I will be back in the office on Thursday and will be able to get you the list then as I have to access some of our systems to do so. Also, [IE please reach out to me at one of the numbers below so we can brain storm. Thanks. NY CART Coordinator Senior Forensic Examiner |, MR (USANys)" > wrote: Following up on the below, | think you had said you expected to be able to get us a list of the devices York and the USVI, as well as from his d from the search warrants at Epstein’s residences in New ence call a month ago) — so wanted to check on arrest, in about a month (d son up on? We're f we can still ex that list to be able to do an updated search warrant on all of the Please let us know the c nt timeline — and also the current timeline on producing the results from those August and September searches? | think you and J 0 coordinate on that, and you had mentioned you expec were goi we'd have it a couple W. s from our call, which would be about a month from now. Want o make sure we’re still on From: ZZ HL.) > Sent: Tuesday, April 07, 2020 15:27 : SANS) a; a PE (SANs) —- eS) a a ‘\\) Cc: EE ER (USANYS) [Contractor] x: TH GE (Usanys) a es < | ee (SVS) ss (\) |) Subject: RE: Epstein search warrant documents Ok let’s plan on 11am tomorrow morning, | am trying to get an FBI h a larger capacity but | won't know until tomorrow am. | will push it out when confirmed 3503-042 Page 7 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002173 EFTA00157353

--=PAGE_BREAK=--

Thanks = Sent: Tuesday, April 07, 2020 3:15 PM a a 6 a a (USANYS) <a Cc: EE MN (USANYS) (Contractor) a; a, <I 2 i. gf (USANYS) i SS (\y) (5!) <a Subject: RE: Epstein search warrant documents can do d on your end nytime tomorrc a CMM cane 0 join anytime tomorrow. So whenever is Also, we can host a conference call, but only up to six lines at a time — so if FBI has larger capacity than that let us know, otherwise I'd propose we do nts to join (and if not, one of JE / HE) Sent: Tuesday, April 07, 2020 14:13 To: i A (USANYS) E:T PB (Vy) (F 51) Cc: EE GR (USANYS) (Contractor) <q: GE. EE (says) <2.) yr _ Subject: RE: Epstein search warrant documents i. Are y ou available tomorrow for a conference call to discuss this issue? FBI New York 3503-042 Page 8 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002174 EFTA00157354

--=PAGE_BREAK=--

On Apr :55 PM, |, (USANYs)" > wrote: Following up on this from a month ago —! know we're living in a different world than what existed four weeks ago, but are you at all able to assist while working remotely? This has been pending for almost two months and we still don’t have a ve ach device or item that v eized and searched, or for which of those we've received materials. We're happy to have a call if that would be useful, but as a first ep the most basic thing we’re looking for is the info in the template spreadsheet we sent earlier (that’s also attached) thanks, From: EE ER (USANys) Sent: Monday, March 09, 2020 12:00 To: i 8 (\Y) (°o!) a: PB (Sys) > a eS a ee (USANYS) <i Cc: EE. EE (USANYS) (Contractor) -; H. B ( says) > es | (SS) ee) 8) Subject: RE: Epstein search warrant documents Unfortunat ? don’t think this is very helpful to us. Did you take a look at the example spreadshe | sent in the The excel file you sent has descriptions that don’t ma up to the items lis e sent on 2/23), and we don’t have the 1B or CART numbers to cific search warrant returns (that w able to cross-reference. We also can’t tell what you mean by “loose media” without a s comparison to what was seized, we don’t know which items you’ re referring to m nes,” and we can’t tell whether the entirety of any particular item has been transferred, or just partial. For exame le, it looks like we have gotten very, \ mage files, which is surprising We have also encountered some very significant problems in trying to review the more than 1 million documents we recently received received has no \ to put any emails and attachments together. So if an email says, “see the attached flight records,” for example, we have no way of linking that up with the records themselves. Not only is that a big problem for us in review, it’s going to be a huge pro counsel. em for producing the documents to defens - The load file has no link to the native file, so when we load the data to the database, there’s no way to have the native files show up in the database. Because many of the files are too large to open in the viewer, it effectively means that there are many files that are completely 3503-042 Page 9 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002175 EFTA00157355

--=PAGE_BREAK=--

nvisible to us. Related, the control numbers in the load file don’t match up to the native files. So we have »f numbers and no way to match up anything—that is, even if we were to try to go 1 every individual large file in the native files, it would be impossible So the data that we most recently got, we need to get in a form that addresses those issues, and we likely will need to get a similar reproduction of the data we received a couple months ago Otherwise we're sifting through more than a million documents without much rhyme or reason ve re-attached the ent last week —| think that’s a good place to start in terms of our necessary record- we need that info at the very least, as well as anything else you think would be useful. Also attaching the SW returns for ce. And again, we're happy up anytime and hash all this out in person if that’s useful thanks, = From: i 0.) —— Sent: Wednesday, March 04, 2020 16:36 To: ES SANS) a; a PE (USANYS) 8) a: a (USANYS) <a Cc: BE (USANYS) (Contractor) -- B (USANYS) ef —S SO (6 5') Subject: RE: Epstein search warrant documents Office for taint e were 9 IDE hard drives found in the Manhattan Here is a listing of what | have already handed over in load files to the US Attorn oints of clarification: T o be cess (as they \ All the loose media from the NY review. Sorr a July earch n total) fror properties. | only p pre apartment is included. All the Windows machines from the NY apartment are included. Only 2 Macs from NY and 1 from the Island are included | will have to more closely coordinate with whoever is loading up Relativity with the remaining Macs as the tool they have to be processed with does not easily re-name the load files Spreadsheet is attached a NYO CART Coordinator Senior Fore Examiner 3503-042 Page 10 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002176 EFTA00157356

--=PAGE_BREAK=--

Sent: Tuesday, March 03, 2020 12:25 PM To i.) a: a PM (UsAnys) SY) 2) a: a (USANYS) <i Cc EE USANS) (Cont <tc) i USNS) i a (.\) :) Subject: RE: Epstein search warrant documents | could do Thursday morning, but | think it would be helpful for us to get the accounting in advance of the meeting so we can figure out in advance what (if any) additional steps we need — is that possible? From: i HS EY) (Fo!) Sent: Tuesday, March 03, 2020 09:59 Cc: I ER (USANYS) (Contractor) qx; HE. GE (Usanys) a ee < (S45) eS) < Subject: RE: Epstein search warrant documents Can we do Thursday morning? My network should be back by then and I can give you a good accounting. NY CART Coordinator Senior Forensic Examiner cell desk , PS (UsANYs)’ > wrote: Doing the weekly check in on this — is there a time this week when everyone can meet on this? On Mar 2, 2020 11:15 AM, " From: EE ER (Sys) Sent: Monday, February 24, 2020 17:38 To: a (NY) (el) a; a sans) 3503-042 Page |1 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002177 EFTA00157357

--=PAGE_BREAK=--

(USANYS) <i Ce: I ME (USANYS) [Contractor] i; i ME (USANYS) : _ ff «| feo -——————_ 7 —jiti, Subject: RE: Epstein search warrant documents Totally understand about the network issues—we can relate. | do still think it will be helpful tc down together to have an in-person discussion, to make sure everybody is on the same page. Are folks available for that next ? And what | think would be most helpful to facilitate that would be a spreadsheet of each separate device reference columns for whether we’ve dumped the contents, w s were transferre transferred, what pc ful—and the you think would be u Somet hing roughly like the attached, with any other categori nfo on the attached is r pothetical, obviously, just as examples. That will help us fully understand what’s been reviewed, transferred, and received so far, and what remains. (Also just on the pictures, we do want copies of those as well, please including from the discs and the dev think FBI was going to do an initial screen to make sure no CP, and since | think the o, we'll need to get those to be able to review them as well.) many thanks, From: i BLY (5 ___- Sent: Monday, February 24, 2020 09:24 To i SNS) a a PIN (SAYS) .)) (SANS) Cc: I. BE (USANYS) (Contractor) [PME (USANYS) : ff [| (uo a eS .) <a Subject: RE: Epstein search warrant documents Sorry for the delayed response. They are tearing out our old network and giving us a new one, they mandated we delete old stuff (about 400 TB worth). Now that they are working on replacing the network, we can do only local work. I should be able to give you an accounting of what is what. I can say, off the top of my head, that all windows based items from the NY search have been handed over as well as all loose media. The CDs from NY only contained pictures, no documents. There are still some Apple items from NY that need to be produced. As far as the Island stuff goes, the Ist item on your spreadsheet, the "kitchen" mac has been produced. Still working on the rest. 3503-042 Page 12 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002178 EFTA00157358

--=PAGE_BREAK=--

NY CART Coordinator Senior Forensic Examiner cell desk |, BE (US ANys)" > wrote: On Feb 23, 2020 12:21 AM," Team, Following up on the below from last weekend, I’m still not sure how we're addressing this so | e a (hopefully relatively brief) meeting to all get on thought it would make sense for us to all sch Gu s7 \y the same page? We didn’t hear back on which files had previously been provided, but our tech folks did their best to differentiate, and we got ess to the materials yesterday and its well over a million documents, and we don’t have any idea what we're looking at —i-e., whic materials came from, whether it’s full or partial results, how many more devices we have coming, Based on the attached search warrant returns, it looks like from the New York mansion (the PDF) there are approximately 40 devices that would have storage (computers, hard drives, thumb drives, etc.) and that’s not even counting at least 60+ CDs. And then from the Virgin Island spreadsheet), at least more than 25 devices, including multiple servers / server racks. du ce. The case team will be So we gotta know what w received, what remain and | know icipat t’s a lot of moving pieces on all sides so wanted to loop in everybody at o' n California this coming week from Tuesday through Friday, but then | think generally around the first week of March, which will hopefully be plenty of time to schedule a productive meeting. thanks all, From: i EE (USANys) Sent: Saturday, February 15, 2020 16:30 To: i I (1) (81 a Ce: I MN (USANYS) (Contractor) <i; . hr re Oe FTC Subject: RE: Epstein search warrant documents I'm not sure who’s the exact right person to ask this, so wanted to get everybody on one email chain about it—| have the hard drive that [J dropped off that has new Epstein search warrant materials, but it looks like there are also old materials (that | think we had previously received and 3503-042 Page 13 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002179 EFTA00157359

--=PAGE_BREAK=--

uploaded??) on the hard drive, and so I’m not sure what’s new. Just generally, and J and | talked about this last week too, but it’s basically impossible for us to keep track of what we’re getting, and what has been completed, without some kind of identification or labeling system, along with a list of which devices have been extracted and downloaded. So for example on the hard drive currently, there are 38 folders labeled “loadFiles” through “37loadFiles” with a modified date of 11/14/19, which | think we may have already previously received — but I’m not sure, because we haven't gotten any info on which folders match up to which devices, etc. And then there’s another folder titled “NYC0O24362” that has a modified date of 1/27/20, so | think that may be the materials we hadn't previously received? That folder by itself has more than 600,000 items. | don’t want to give [J anything that we've already previously received and uploaded, and | can’t tell from the folder or file names whether everything on the drive is new, or whether just additional materials were saved onto it in addition to what we already have. [J are you able to give us some guidance on this? Ultimately what we really need is a spreadsheet of every device, whether it’s been dumped (or partially dumped), and then identifying that same info — which device, and what materials from it — are being given to us with each data transfer. Otherwise | think organizationally and for review purposes it will be a total disaster for us. We're happy to have a meeting on this if that’s helpful — and thanks everybody for the assistance. Assistant U.S. Attorney Southern District of New York 3503-042 Page 14 of 14 SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00002180 EFTA00157360