PLIST FORENSIC SEARCH REPORT

Exhaustive Database Search for Apple Property List (PLIST) Content & EFTA00524160

Generated: 2026-02-07
Databases Searched:
- the primary document text database
- the Dataset 10 document text database
- the OCR text extraction database
- the image catalog database

1. EFTA00524160 -- SEARCH RESULTS

Finding: EFTA00524160 DOES NOT EXIST in any database.

The specific EFTA number EFTA00524160 was NOT found in any of the four databases. However, a closely related number was found:

EFTA01524160 -- This document DOES exist:
- File: DOJ dataset file dataset10/VOL00010/IMAGES/0135/EFTA01524160.pdf
- Content: JPMorgan Chase Private Bank statement for Ghislaine Maxwell
- Statement period: April 1, 2003 -- April 30, 2003
- Account: Premier Checking, c/o New York Strategy Group, Attn: Eric Gany
- Opening balance: $3,499,315.96
- Total credits: $3,991.98
- Total debits: $23,745.79
- Ending balance: $3,479,564.15
- Private Bank Team: Maria Hornak
- Bates numbers: JPM-SDNY-00051945, SDNY_GM_00321143

• Redaction analysis (v2 & ds10): 2 redactions detected, both classified as proper_redaction with low confidence (0.5051, 0.5609). Hidden text was empty (nothing recovered beneath redactions).
• Document summary: 2 total pages, 0 with recovered text, 2 redacted pages

Assessment: EFTA01524160 is a financial document (bank statement), NOT a PLIST-encoded document. The caller may have had the wrong EFTA number, or the number may have been confused. This is a JPMorgan banking record, not Apple device data.

2. PLIST CONTENT -- COMPREHENSIVE FINDINGS

2.1 Scope and Scale

Total unique documents containing Apple PLIST metadata (OCR database only): approximately 460+

Revisit note (2026-02-12): The full text corpus (1,380,937 documents across all 12 datasets) reveals a scale approximately 200x larger than the OCR database captured: 93,634 documents with gmail-label-ids, 18,160 with original-mailbox references, and 84,401 with date-received + plist co-occurring. DS11 alone contains approximately 75,630 PLIST-containing documents. The OCR database captured less than 0.5% of the actual PLIST corpus. The 460+ figure below reflects only the OCR database subset.

2.2 What This Data Actually Is

THIS IS NOT DEVICE BACKUP DATA. The PLIST content found across these documents represents Apple Mail (Mail.app) email metadata that was embedded within printed/exported emails. Specifically:

The PLIST fragments are Apple Mail's internal message metadata, automatically appended when emails were exported from Mail.app or Apple's email system. The standard structure found is:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>conversation-id</key>
    <integer>[ID]</integer>
    <key>date-last-viewed</key>
    <integer>0</integer>
    <key>date-received</key>
    <integer>[UNIX_TIMESTAMP]</integer>
    <key>flags</key>
    <integer>[FLAG_VALUE]</integer>
    <key>gmail-label-ids</key>
    <array>
        <integer>[LABEL_ID]</integer>
    </array>
    <key>original-mailbox</key>
    <string>imap://[EMAIL_ACCOUNT]/[FOLDER]</string>
    <key>remote-id</key>
    <string>[MESSAGE_ID]</string>
</dict>
</plist>

2.3 Email Accounts Identified in PLIST Metadata

The [email protected] account is forensically significant -- it reveals that Sarah Kellen's Mac computer running Apple Mail was used to access and export some of these emails. The IMAP mailbox references show folder paths like imap://[email protected]/Sent%20Messages.

Revisit note (2026-02-12): DS9 also reveals the [email protected] transitional Apple domain, with 39 documents including flight coordination emails with Nadia Marcinkova (EFTA00415730: "330 wheels up WED the 11th from lsj to ny") and direct emails to Epstein (EFTA00422779). The total sarahk525 count expands from 11 to 1,465 documents across DS9/DS11.

2.4 Date Range of PLIST-Embedded Email Metadata

Based on Unix timestamps extracted from date-received fields:

• Earliest: September 1, 2009 (timestamp 1251822309)
• Latest: October 5, 2018 (timestamp 1538761712)

This spans approximately 9 years of email activity from 2009 to 2018.

2.5 Key Flag Values Observed

3. PLIST DATA IN REDACTED (HIDDEN) TEXT

These 12 documents had PLIST content recovered from BENEATH redactions -- meaning the PLIST metadata was actively hidden by redaction overlays:

Documents with PLIST Recovered from Redactions (primary document text database)

Assessment: These are all classified as bad_overlay redactions with high confidence (0.77-0.99). The redaction overlays were improperly applied and failed to fully conceal the underlying PLIST metadata. This is consistent with someone using PDF redaction tools that did not properly flatten the document -- the PLIST XML text that was part of the email export was not fully obscured.

All 12 of these come from dataset10 (EFTA01) and dataset11 (EFTA02).

4. NOTABLE EMAILS WITH PLIST METADATA (by person referenced)

4.1 High-Profile Individuals in PLIST-Containing Emails

4.2 Lesley Groff (Epstein's Executive Assistant) -- Heaviest PLIST Presence

Lesley Groff appears in 40+ documents with PLIST metadata in the OCR database, making her the most frequently appearing person in the Apple Mail data. Her emails consistently show the plist metadata pattern, indicating she was a primary user of Apple Mail for Epstein-related correspondence. DS9 contains additional Groff email chains showing her [email protected] account (the "JEE" = Jeffrey E. Epstein naming convention mirrors [email protected]), including EFTA00432172 and EFTA00436223 (furniture shopping at 301 E 66th, March 2011).

4.3 Ann Rodriquez (Epstein's Housekeeper, USVI)

Ann Rodriquez appears in 6+ documents with PLIST, including:
- EFTA02388589: "I'm so sorry about your arrival back home (it won't happen again)"
- EFTA02518872: "Hey Bossman, What time should I prepare your Lunch?"
- EFTA02554183: Re: WAPA (Clinton Hedrington power company issue on St. Thomas)

5. CELLEBRITE AND DEVICE FORENSIC REFERENCES

5.1 Cellebrite References (17 documents in DS8; 21+ in DS9)

Revisit note (2026-02-12): DS9 alone contains 21+ Cellebrite-referencing documents, expanding the total beyond the 17 identified in DS8. New DS9 documents include: EFTA00164855 (CART download of 80GB Cellebrite report from a contraband phone, April 2025); EFTA00173373 (FBI CACHTU inspection revealing Axiom, Cellebrite, and GrayKey purchased via UCO funds); and EFTA00164740 (March 2025 evidence review referencing CART/Cellebrite procedures).

The following documents reference Cellebrite forensic extraction software:

5.2 Key Forensic Finding: Apple Devices Required Cellebrite

Per EFTA00020322, the government explicitly stated that images seized from Epstein's Apple devices required Cellebrite software to view. This confirms:
1. Apple devices were seized from Epstein
2. Cellebrite was used to extract data from these Apple devices
3. The extracted data was provided to defense on hard drives

5.3 Steve Bannon's iPhone 7

Per EFTA00025553 and EFTA00030999, during a Cellebrite review of Steve Bannon's iPhone 7 (as part of an apparently separate "WBTW" case), an image of Trump and Ghislaine Maxwell was found on Bannon's phone. This cross-case discovery was flagged internally.

6. SARAH KELLEN'S APPLE MAIL DATA

Documents with [email protected] IMAP References

These documents contain Apple Mail PLIST metadata with IMAP mailbox paths pointing to Sarah Kellen's .mac.com email, indicating these emails were exported from her Apple Mail application:

Forensic significance: The presence of imap://[email protected]/Sent%20Messages in the PLIST metadata proves these emails were stored in and exported from Sarah Kellen's Apple Mail account on a Mac computer. The .mac.com domain was Apple's pre-iCloud email service (later transitioned to @me.com and then @icloud.com).

Sarah Kellen's Mac -- Property-Organized Email Folders (DS9 Expansion)

Revisit addition (2026-02-12): EFTA00511040 (DS9) is a Cellebrite forensic extraction report for device NYCO24329 (Macintosh HD, AFF4 forensic image format). It reveals Kellen's complete Mac Mail folder structure organized by Epstein property:

• /Users/(Deleted)/Library/Mail/V2/Mac-sarahk525/Work.mbox/LSJ.mbox/ -- emails organized under Little Saint James island
• /Users/(Deleted)/Library/Mail/V2/Mac-sarahk525/Work.mbox/71st.mbox/ -- emails organized under the 71st Street Manhattan townhouse
• /Users/(Deleted)/Library/Mail/V2/MailData/Envelope Index -- master email database

The account was marked (Deleted) -- the user profile had been deleted before forensic imaging, indicating attempted evidence destruction. The Work.mbox parent folder confirms these were treated as work-related communications.

The same Macintosh (NYCO24329) also contained /Users/karyna/Library/Mail/V6/ -- Karyna Shuliak's user account, establishing a device continuity chain from NPA-protected co-conspirator (Kellen) to Epstein's later partner (Shuliak).

EFTA00518756 shows top contacts analysis: sarahk525 had 22,524 messages with her top contact, 12,304 with the second, and 10,952 with the third.

Skype Call Logs -- Device NYCO24329 (DS9 Expansion)

Revisit addition (2026-02-12): EFTA00511018/EFTA00511023 (DS9): Cellebrite extraction from NYCO24329 includes complete Skype audio call logs spanning September 2012 through January 2014, with both incoming and outgoing calls documented. Many calls show "Cancelled" status. This provides an additional communication channel not previously documented.

7. COMPLETE LIST OF EFTA NUMBERS WITH PLIST CONTENT

7.1 From OCR Database (268 unique documents)

The full list of 268 EFTA numbers is extensive. Key EFTA ranges:
- EFTA02299110 - EFTA02300584 (early batch)
- EFTA02303801 - EFTA02323093 (Sarah Kellen batch)
- EFTA02351725 - EFTA02406465 (mid-range)
- EFTA02453274 - EFTA02502971 (later batch)
- EFTA02513964 - EFTA02571051 (largest batch -- Lesley Groff emails)
- EFTA02584723 - EFTA02700500 (latest batch)

7.2 From Redaction Analysis (12 unique documents, all with bad_overlay redactions)

• EFTA01758519, EFTA01765156, EFTA01766832, EFTA01774075, EFTA01774370
• EFTA01781767, EFTA01792918, EFTA01793116, EFTA01802972
• EFTA02114558, EFTA02522767, EFTA02696356

8. ASSESSMENT AND CONCLUSIONS

8.1 Nature of the PLIST Data

The PLIST content found across these 460+ documents is Apple Mail internal message metadata, NOT:
- iPhone/iPad device backups
- Safari browsing history
- Contacts databases
- Location data
- App usage data

The metadata was embedded because emails were exported from Apple Mail (Mail.app on macOS) in a format that included the internal PLIST representation. This happened because:
1. The emails were printed or exported to PDF directly from Apple Mail
2. Apple Mail's internal metadata (conversation-id, date-received, flags, gmail-label-ids, remote-id, original-mailbox) was included in the export
3. The metadata was not stripped before the documents were produced in discovery

8.2 Forensic Value

Despite not being device backup data, this PLIST metadata is still forensically valuable because:

1. Email Account Identification: Confirms [email protected] (Epstein) and [email protected] (Kellen) as email accounts
2. Precise Timestamps: Unix timestamps in date-received provide exact receipt times (to the second) for emails, independent of what the email header says
3. Gmail Label IDs: The gmail-label-ids fields show how emails were categorized in Gmail, potentially revealing organizational patterns
4. Conversation Threading: conversation-id values could be used to reconstruct email threads
5. Remote Message IDs: remote-id values map to IMAP message IDs on the mail server
6. Mail Client Identification: Proves Apple Mail was used (not just webmail)
7. Folder Information: original-mailbox reveals which folder emails were filed in (e.g., Sent Messages)

8.3 Date Coverage

The PLIST metadata timestamps in the OCR database cover email activity from September 2009 to October 2018 -- a 9-year window ending approximately 9 months before Epstein's arrest on July 6, 2019. With the full corpus, DS9 Cellebrite extractions provide device-level timestamps independent of email PLIST metadata, and the PLIST date range may extend further.

8.4 Redaction Failures

12 documents in dataset10 had PLIST content that was supposed to be redacted but was recoverable due to bad_overlay redactions (high confidence 0.77-0.99). This suggests the redaction process did not properly handle the XML/PLIST metadata embedded in the email exports.

8.5 Previously Analyzed vs. New Findings

• The OCR-based findings (268 documents) represent data visible in the document text and captured by OCR processing. These would be available to anyone examining the documents.
• The 12 redacted PLIST documents from the redaction analysis are potentially NEW findings, as the PLIST content was hidden beneath redaction overlays and only recovered through the document analysis process.
• The Cellebrite/forensic device references (17 documents in DS8; 21+ in DS9) provide context about how Apple device data was handled in the case but are visible in the document text.

8.6 Regarding EFTA00524160

EFTA00524160 does not exist in any database. The closest match is EFTA01524160, which is a Ghislaine Maxwell JPMorgan Chase bank statement from April 2003 with no PLIST content whatsoever. The original query about this EFTA number having "PLIST encoding" appears to be based on incorrect information.

APPENDIX A: Sample PLIST Metadata (EFTA02570954)

Full recovered text showing typical Apple Mail PLIST structure:

From: [redacted]
Sent: Thursday, June 13, 2013 9:43 PM
To: [email protected]

Salam capt keith holland

Sent from my iPhone

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>conversation-id</key>
    <integer>257285</integer>
    <key>date-last-viewed</key>
    <integer>0</integer>
    <key>date-received</key>
    <integer>1371159841</integer>   [= June 13, 2013 5:44:01 PM]
    <key>flags</key>
    <integer>8590195713</integer>
    <key>...

APPENDIX B: Sample PLIST Metadata with IMAP Mailbox (EFTA02323043)

> any help/input would be appreciated!
> Thanks chica

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>flags</key>
    <integer>8590195713</integer>
    <key>original-mailbox</key>
    <string>imap://[email protected]/Sent%20Messages</string>
    <key>remote-id</key>
    <string>4043</string>
</dict>
</plist>

APPENDIX C: Cellebrite Apple Device Evidence (EFTA00020322)

All electronic images should be viewable as thumbnails, except those seized
from Apple devices, which must be viewed using Cellebrite.

The Cellebrite software will be provided on the drive for your review of
images and videos seized from Apple devices.

The electronic files have the same metadata on the hard drive that was
available when the FBI seized each image. For images that were carved or
deleted, no metadata was recovered, so none is viewable.

End of Report