US. Department of Justice Office of the Inspector General REPORT OF FORENSIC EXAMINATION SUBMITTER DATE SUBMITTED CASE NUMBER Special Agent New York Field Office December 12, 2019 2019-010614 OFFICE CONDUCTING EXAMINATION CYBER II) SUBJECT(S) Cyber Investigations Office 0452 Correctional Officer Michael Thomas, Federal Bureau of Prisons, Metropolitan Correctional Center, New York, NY DIGITAL DEVICE(S) EXAMINED 1. EnCase Forensic Image of a Seagate 500GB hard drive with the serial number Z6E8KD3N, which was extracted from a BOP owned HP EliteDesk 800, serial number 2UA4381XJW. (Device I) 2. EnCase Forensic Image of a Hitachi 500GB hard drive with the serial number JP1572JE36LSNK, which was extracted from a BOP owned HP Compaq 8200 Elite. serial number MXL14700DY. (Device 2) Synopsis On December 12, 201 U.S. De artment of Justice, Office of the Inspector General (OIG), New York Field Office Special Agent submitted a Digital Forensics Examination Request form seeking analysis of Devices 1 and 2. requested a search of Devices 1 and 2 for a timeline of user activity and work product from 8/9/2019 to 8/10/2019. arranged for the seizure of Devices 1 and 2 under administrative authority from the Federal Bureau of Prisons (BOP), Metropolitan Correctional Center (MCC) located in New York, NY. Devices 1 and 2 were located and seized from the MCC's Special Housin Unit where former inmate David Epstein was housed at the time of his suicide on August 10, 2019. requested that CYBER determine user aciiii.nd attribution for each device prior to, at the time of, and subsequent to the discovery of Epstein's body. further requested any communication and/or documents on the devices regarding Epstein, and requested the search of the keyword "Reyes." OIG Lead Information Technology Specialist Cyber Investigations Office (CYBER), received the above referenced devices for analysis. Leonard successfully processed Devices 1 and 2 with CYBER's forens