(U//FOUO) UNSUB; JEFFREY EPSTEIN — VICTIM; DEATH INVESTIGATION UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology Digital Evidence Tracking (U//FOUO) Executive Summary: The New York Division (NY) initiated a death investigation for the apparent suicide of Jeffrey EPSTEIN at the Metropolitan Correctional Center (MCC) which occurred on 10 August 2019. On 12 August 2019, OTD was contacted by the NY Division for assistance with a MCC video surveillance system consisting of two Digital Video Recorders (DVR1 - operational and DVR2 — not operational) and a controller. The NY Division Computer Analysis Response Team (NY CART) has collected digital evidence items associated with this investigation. OTD is currently tracking 36 digital evidence items (associated with DVR1 and DVR2): (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful | Time in Process | Location | Access 1B1 — Hard Drive — OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, STSOODMO002, S/N 8/15/2019 - Collected, in evidence control Z3T6CIJA (DVR2 — 1 of pending shipment to OTD. 18) NYCO23578 | | 1B2 - Hard Drive — OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Hitachi SOOGB HDD, DFAU Recovery Program assessment ongoing. 8/16/2019 HDS721050CLA662, S/N JP1572JE36A13K (DVR2 —2 of 18) NYC023579 8/15/2019 - Collected, in evidence control pending shipment to OTD. UNCLASSIFIED//FOUO EFTA00174648

--=PAGE_BREAK=--

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful | Time in Process | Location | Access 1B3 — Hard Drive — OTD- 8/16/2019 — Device arrived at OTD. Data N/A N/A Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST500DMO002, S/N 8/15/2019 - Collected, in evidence control Z3T6CF5X (DVR2-3 pending shipment to OTD. of 18) NYCO23580 1B4 — Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data N/A N/A Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, $T3500320NS, S/N 8/15/2019 - Collected, in evidence control 9QM8MT9P (DVR2 4 pending shipment to OTD. of 18) NYCO23581_—i|fs | 1B5 — Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data Damaged N/A Started: Hitachi SOOGB HDD, DFAU Recovery Program assessment ongoing. 8/16/2019 HDS721050CLA662, Pending delivery of donor parts for repair. S/N: JP1572JE36MWNK 8/15/2019 - Collected, in evidence control (DVR2 —5 of 18) pending shipment to OTD. NYCO23582 1B6 — Hard Drive — OTD - 8/16/2019 — Device arrived at OTD. Data N/A N/A Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, $T3500320NS, S/N 8/15/2019 - Collected, in evidence control S9QMB8EC75 (DVR2 —-6 pending shipment to OTD. of 18) NYCO23583 UNCLASSIFIED//FOUO EFTA00174649

--=PAGE_BREAK=--

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful | Time in Process | Location | Access 1B7 — Hard Drive — OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NMO0011, S/N 8/15/2019 - Collected, in evidence control Z1M1PZPE (DVR2-7 pending shipment to OTD. of 18) NYCO23584 1B8 — Hard Drive - OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Western Digital DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, WDSOOOAVDS- 8/15/2019 - Collected, in evidence control 63U7B1, S/N pending shipment to OTD. WCAV9Z911026 (DVR2 —8 of 18) NYCO23585 | 1B9 — Hard Drive - OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Western Digital DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, WDSOO0AAKX- 8/15/2019 - Collected, in evidence control 60U6AA0, S/N pending shipment to OTD. WCC2EJUC34C) (DVR2 — 9 of 18) NYCO23586 UNCLASSIFIED//FOUO EFTA00174650

--=PAGE_BREAK=--

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful | Time in Process | Location | Access 1B10 — Hard Drive - OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, ST3500320NS, S/N 8/15/2019 - Collected, in evidence control S9QM8MSEZ (DVR2 — pending shipment to OTD. 10 of 18) NYCO23587 1B11— Hard Drive - OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NMO011, S/N 8/15/2019 - Collected, in evidence control Z1M1PX26 (DVR2-11 pending shipment to OTD. of 18) NYCO23588 | | 1B12 — Hard Drive - OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, ST500NMO011, S/N 8/15/2019 - Collected, in evidence control Z1M1Q1FX (DVR2 — pending shipment to OTD. 12 of 18) NYCO23589 1B13 — Hard Drive - OTD- 8/19/2019 — Damaged heads. DFAU performed | Damaged TBD Started: Western Digital DFAU head stack swap, data is slowly imaging. 8/16/2019 500GB HDD, WDSOOOAVDS- 8/16/2019 — Device arrived at OTD. Data 63U7B1, S/N Recovery Program assessment ongoing. WCAV9T870016 (DVR2 — 13 of 18) 8/15/2019 - Collected, in evidence control NYCO23590 pending shipment to OTD. UNCLASSIFIED//FOUO EFTA00174651

--=PAGE_BREAK=--

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful | Time in Process | Location | Access 1B14 -Hard Drive - OTD- 8/16/2019 — Device arrived at OTD. Data Damaged TBD Started: Western Digital DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, Pending delivery of donor parts for repair. WDSOOOAAKX- 60U6AA0, S/N 8/15/2019 - Collected, in evidence control WCC2E0DE83YK pending shipment to OTD. (DVR2 — 14 of 18) NYCO23591 | 1B15 — Hard Drive - OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Barracuda DFAU Recovery Program assessment ongoing. 8/16/2019 500GB HDD, $T3500320NS, S/N 8/15/2019 - Collected, in evidence control 9QM8MTED (DVR2 — pending shipment to OTD. 15 of 18) NYCO23592 | 1B16 — Hard Drive - OTD- 8/16/2019 — Device arrived at OTD. Data TBD TBD Started: Seagate Constellation DFAU Recovery Program assessment ongoing. 8/16/2019 ES 500GB HDD, STSOONMO011, S/N 8/15/2019 - Collected, in evidence control Z1M1PZ07 (DVR2 — 16 pending shipment to OTD. of 18) NYCO23593 UNCLASSIFIED//FOUO EFTA00174652

--=PAGE_BREAK=--

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful | Time in Process | Location | Access 1B17 — Hard Drive - OTD- 8/19/2019 — DFAU reports 100% data recovery, Damaged TBD Started: Seagate Constellation DFAU device is currently imaging. 8/16/2019 ES 500GB HDD, ST500NMO0011, S/N 8/16/2019 — Device arrived at OTD. Data Z1M1LOYG (DVR2 - 17 Recovery Program assessment ongoing. of 18) NYCO23594 8/15/2019 - Collected, in evidence control pending shipment to OTD. | 1B18 — Hard Drive - OTD- 8/19/2019 — DFAU reports partial data recovery | Damaged TBD Started: Seagate Barracuda DFAU (44 bad sectors not recovered), device is 8/16/2019 500GB HDD, imaging. ST3500320NS, S/N SQM8MSRR (DVR2 - 8/16/2019 — Device arrived at OTD. Data 18 of 18) NYCO23595 Recovery Program assessment ongoing. 8/15/2019 - Collected, in evidence control pending shipment to OTD. 1B19 — Disk Array OTD- 8/16/2019 — Chassis and controller for TBD TBD Started: Chassis; Model#: SA- DFAU inoperable DVR2 arrived at OTD. Data Recovery 8/16/2019 6640S, SN: Program assessment ongoing. F96168201-004 and Disk Array Controller; Model#: NP-2000, SN: 43144902 (DVR2) UNCLASSIFIED//FOUO EFTA00174653

--=PAGE_BREAK=--

UNCLASSIFIED//FOUO Operational Technology Division Countering Threats Through Technology (U//FOUO) 90A-NY-3151227 Digital Evidence items — As of 19 August 2019 1400 Description Physical Status Challenges Lawful | Location | Access Time in Process Started: 8/16/2019 1B20—- DVR OTD- 8/16/2019 — DVR controller for operable DVR1 TBD TBD Controller - Dell DFAU arrived at OTD. Data Recovery Program PowerEdge R420 DVR assessment ongoing. Controller, Barcode# 5BMQZ12, Express service Code #: 11587249622, Manufacturer date: 20140829 (DVR1) 1B21— DVR System - OTD- 8/16/2019 — Operable DVR1 system arrived at TBD TBD Started: Disk Array Chassis DFAU OTD. 8/16/2019 containing 16 hard Drives; Model#: Premium 8600, SN: 232476 and Disk Array Controller; Model#: NP-2000, SN: 43144901 (DVR1) 1B22 — 1B36—- NY CART | 8/19/2019 — Derivative evidence — clone copies | N/A N/A TBD Derivative Evidence — of hard drives removed from DVR2. Collected 14 Hard Drives by DFAU UC Petronella to be delivered to OTD containing clone on 8/20/2019 copies of multiple Hard Drives from DVR2. UNCLASSIFIED//FOUO EFTA00174654