From: Laura Menninger <linenningerghinflaw.com> To: ' USANYS)" Cc: Jeff Pagliuca <jpagliucaghinflaw.com>, '"ceverdellgcohengresser.comm e-ceverdel cohengresser.com>, "'Bobbi Sternheim ([email protected])"' <bcstemheiinginac.com> Subject: RE: US v. Maxwell - [conferral re photo and other discovery deficiencies) Date: Thu, 20 May 2021 19:27:58 +0000 lnline-Images: image001.png; image002.png Thank you for your explanation. I also have gone back to our IT department and, unfortunately, your FBI/vendor explanation is insufficient. • Based on our review, which has been double-checked, there are hash values in the overlay that don't match the index and visa- versa. • The snips below show an example of an entry from the overlay file you provided (with file names and MD5 Hash) which did not join to the non-nude index. We were able to find the corresponding file in the index using the file name, which in this particular instance was unique. As you can see, the MD5 hashes don't match. From the overlay file ProdbegBates - File Name MD5 Hash SDNY_GM_00503260 Jeffrey VF2.psd DA92DFS7819FCC13F38E0584D8D77DFB SDNY GM 00506551 LSJ librarywindow150dpi.tif 58AC5CBE826591AEFD0604ABA226272D From non-nude index SHA-1 MD5 LSI IlbrarywIndow150dpItif 043670EDF17D3SEE5794EBDF094AEF63A95D489A BDEI366247E99D1C9EED2BA3OFB8F72D5 More importantly, if as you report you did not deduplicate the production and if the index you produced is accurate, we should be able to match files based on the combination of File Name and MD5 hash. The hash + file name combination might not be unique, but each hash+file name value in the index should have a corresponding entry in the overlay unless hash values and/or file names were modified somewhere in the process. • As previously reported, if we require a match on the hash value and ignore file names, there are 65 production numbers that don't match the index. • There are more entries in SDNY011 (40,567) than entries on the non-