COMPLETE DIGITAL DEVICE FORENSICS ANALYSIS

Jeffrey Epstein DOJ Files -- Comprehensive Device, Evidence & Chain-of-Custody Report

Date: 2026-02-07
Databases searched: primary document text database, Dataset 10 document text database, OCR text extraction database, image catalog database
Total unique EFTA documents analyzed: 150+
Search terms: Cellebrite, EnCase, XRY, FTK, Blacklight, BERLA, forensic exam, CART, chain of custody, hard drive, iPhone, iPad, MacBook, encryption, seized device, CAIR, Relativity, digital evidence, DVR, NiceVision, server, data recovery

EXECUTIVE SUMMARY

The Epstein DOJ files reveal a forensic evidence operation of significant scope -- and significant processing dysfunction. Between July 2019 and late 2021, the FBI seized over 70 digital devices from Epstein's New York mansion (approximately 40 storage devices plus 60+ CDs) and his US Virgin Islands properties (25+ devices including multiple servers and server racks). The processing of this evidence was plagued by:

• 17+ months of delays between seizure and usable production to prosecutors
• Terabytes of data spanning phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers
• Encrypted devices that required specialized cracking
• Server hard drives that physically failed, requiring FBI HQ data recovery specialists
• 71,000+ zero-byte (empty) files in initial productions
• No standardized tracking system -- prosecutors could not match folders to devices
• Catastrophic DVR failures at MCC that destroyed surveillance footage from the night of Epstein's death
• A 2005 Palm Beach computer forensic image on 16 DVDs that was never searched due to lack of legal authority
• 2,100 nude/partially nude images from devices designated "Highly Confidential"
• The FBI CART examiner was reduced to 1 day per week during COVID, stretching timelines by "a factor of 5"
• Evidence review still ongoing as of April 2025 -- 6 years after seizure

March-July 2025 FBI Evidence Review (DS9 expansion): Internal communications between Director Patel, DD Bongino, AUSAs, and FBI NY provide definitive FBI conclusions:

• No sexual abuse videos found -- ever (EFTA00164742): AUSA Comey explicitly stated to Director Patel and DD Bongino: "there were no videos of any sexual abuse identified at any point in the investigation."
• Over 1 million images/videos extracted from devices (EFTA00164897, EFTA00161426): ~34,000 marked responsive (85 GB), 15-20 CSAM images (commercial, not self-produced), ~90% adult pornography/erotica, ~9% generic images
• Camera-in-clock practice documented to 2003 (EFTA00157526): Palm Beach PD burglary report -- 2 years before the 2005 sex trafficking investigation
• MCC surveillance: 147 cameras, 8.08 TB (EFTA00164855): SHU cameras not active at time of death
• Epstein received an unmonitored phone call the night before his death (EFTA00061927): Recipient never identified

PART I: COMPLETE SEIZED DEVICE INVENTORY

Source: EFTA00038465 -- CART EVIDENCE (Jeffrey Epstein), Case 50D-NY-3027571

This is the master evidence log. Devices are catalogued by "1B" item numbers:

A. NEW YORK MANSION SEIZURE (July 6, 2019 search warrant)

Desktop Computers:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B28 | Silver Apple Desktop Computer with keyboard and mouse | |
| 1B41 | HP Compaq Machine | |
| 1B42 | Cube 9000 Siteserver (BLACK/SILVER) | |
| 1B43 | Dell Machine | |
| 1B53 | Apple Desktop Computer with keyboard and mouse | |
| 1B54 | Apple Desktop Computer with keyboard and mouse | |
| 1B57 | Gray Apple Desktop Computer with keyboard and mouse | |
| 1B59 | MSI PC computer in a brown box | |
| 1B61 | Dell Precision Tower 5810 | |
| 1B70 | Apple Desktop Computer | |

Laptops:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B62 | Sony Vaio Laptop | NYCO24336/24337 per search warrant |
| 1B96 | Toshiba Laptop with charger | |
| 1B97 | HP laptop with charger, S/N CND81368V5 | |

Phones & Tablets:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B55 | White Apple iPhone 5 (in cellophane) | |
| 1B67 | Space Gray Apple iPad | |
| 1B68 | Space Gray Apple iPad | |
| 1B69 | Silver iPad - 64GB | |
| 1B71 | Black iPhone, IMEI 357201093322785 | NYCO24318; This is the critical Epstein iPhone |
| 1B72 | Silver iPad, S/N DLXQGM3KGMW3 | |

Hard Drives & Storage:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B29-1B37 | 9x Seagate Path/100 Hard Drives | |
| 1B38-1B39 | 2x Data Traveler 4GB USB (in cellophane) | |
| 1B40 | Mentor Media 32GB USB (in cellophane) | |
| 1B44 | Silicone Power Micro SD Adapter with 16GB SD Card | |
| 1B46 | EMTEC 16GB USB | |
| 1B47 | Blue EMTEC 16GB USB | |
| 1B48-1B51 | 4x Cruzer Guide 32GB USB | NYCO24344-47 |
| 1B52 | SPIEF 2014 Silver USB | |
| 1B56 | Seagate Backup Plus Portable Drive - 1TB | |
| 1B60 | Seagate Barracuda 7200 hard drive 80GB | |
| 1B73-1B74 | 2x Black Hard Drive | |

Optical Media:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B45 | 10 Assorted CDs | |
| 1B63 | 45 Assorted CDs | |
| 1B75 | Two Blue Binders with 58 Discs inside | |
| 1B78 | 4 binders with 68 discs inside | |

Recording Devices:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B64 | Sony BM-560 Recorder | |
| 1B65 | Silver Olympus Recorder | |
| 1B66 | Black Radio Shack Recorder | |

Cameras:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B58 | Sony Camera with black case | |
| 1B99 | Red Nikon camera | |

B. USVI / LITTLE ST. JAMES ISLAND SEIZURE (August 2019 search warrant)

Desktop Computers:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B80 | Mac Desktop labeled "Kitchen Mac" - grey | First USVI device produced |
| 1B85 | Silver Mac Desktop with mouse/keyboard, S/N CO2NM1MOFY14 | |
| 1B87 | Silver Mac Desktop | |
| 1B98 | Silver Desktop Mac with Keyboard | |
| 1B102 | Silver MacBook Desktop with keyboard | |
| 1B107 | Silver Mac desktop, Model A1312, S/N W804736DDAS | |
| 1B118 | Silver Mac Desktop | |
| 1B21 | Mac Desktop, S/N W89524CZPJ, Model A1312 | |

Laptops:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B81 | Silver Mac Laptop labeled "JE BIG LAPTOP" in black bag | "Black Bag" brand |
| 1B82 | Silver MacBook Pro, S/N CO2ZAMOGUQWOP | |

Tablets:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B83 | Silver iPad Model A1567, S/N DMPQL25NGSYPY | |
| 1B84 | Silver iPad Model A1567, S/N DMPQLIRMGSY, in case | |

Other Apple:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B103 | Apple iPod Shuffle on watch band | |

Servers & Networking:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B15 | HP Server with 4x 500GB drives, S/N MXQ3220187 | |
| 1B16 | Panasonic KX-TDE100, S/N KX-TDA0149LCCD005398 | Telecom system |
| 1B17 | 6 Bay with 146GB drives, S/N MXQ824A1R | |
| 1B109 | Unifi Cloud Key, M/N UN-CK | |
| 1B111 | Unifi Video NVR, M/N UVC-NVR-278 | Network video recorder |
| 1B112 | Unifi Server | |

Windows PCs:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B19 | HP Desktop Tower, S/N CNV7160050, Model 260-010 | |
| 1B20 | HP Tower, S/N CNV716004Y, Model 260-2010 | |
| 1B22 | Lenovo Tower, S/N MIO7YG6U | |
| 1B23 | Lenovo Tower, S/N 153306G2UMJXEKGX | |
| 1B24 | HP Tower, S/N CNV742213M3, Model 570-p056 | |

Voice Recorder:
| 1B Item | Description | Notes |
|---------|-------------|-------|
| 1B108 | Olympus Digital Voice Recorder | |

C. DEVICES SEIZED FROM EPSTEIN'S PERSON (July 6, 2019 arrest)

Per EFTA00015561 and EFTA00028481:
- 1 iPhone (seized upon arrest at Teterboro Airport) -- Draft search warrant for "JE phone & iPad"
- 1 iPad (seized upon arrest)

D. NYC CART NUMBER CROSS-REFERENCE

From the evidence tracking emails (EFTA00022331, EFTA00020213, EFTA00032065):

Total estimated NYCO-numbered items: 70-80+

PART II: FORENSIC TOOLS USED

Source: EFTA00029601 -- FBI Forensic Examiner Curriculum Vitae (5 pages)

The lead FBI examiner was based at the FBI Computer Analysis Response Team (CART), 26 Federal Plaza, New York, NY 10278. This individual held the following forensic certifications and training relevant to the Epstein case:

Forensic Software Tools:

Examiner Qualifications:

• FBI CART Basic Wintel Forensic Examiner (Oct 2006)
• PDA/Cell Phone Forensic Examiner (Dec 2007)
• EnCase Certification (Feb 2008)
• Macintosh Forensic Examiner (April 2009)
• Senior Forensic Examiner (Aug 2010)
• Over 1,000 pieces of computer media analyzed across 300+ cases since 2005
• 200+ search warrants / search and seizure operations participated in
• Expert testimony in SDNY and EDNY Federal Court
• Masters in Digital Forensics and Cyber Security, John Jay College (2015-2019)

Additional Tools Used (referenced in documents):

• Relativity -- e-Discovery platform for evidence review (not a forensic tool)
• CAIR -- FBI evidence access/tracking system
• ImageScan -- FBI image review tool (examiner was instructor)
• DExT -- Digital Evidence eXploitation Toolkit (examiner was instructor)

Cellebrite Usage in the Epstein Case:

Per EFTA00020322 and EFTA00015786:
- Cellebrite was required to view images/videos seized from Apple devices
- Cellebrite software was provided on the review hard drive for defense counsel
- Images from Apple devices could not be viewed as thumbnails; required Cellebrite
- The prison computer (MDC) was incapable of running Cellebrite (per EFTA00021015), meaning Maxwell could not review Apple device evidence on weekends/holidays

PART III: WHAT WAS FOUND ON THE DEVICES

A. Nude / Partially Nude Images (Highly Confidential)

Per EFTA00015738, EFTA00015786, EFTA00020322, EFTA00030035:

Three categories of images designated "Highly Confidential":

1. ~2,100 electronic images and videos seized from Epstein's electronic devices
   - Never previously provided to defense until March 2021
   - Separated by folder to indicate which device each image was seized from
   - For "carved or deleted" images, no metadata was recovered
   - Viewable only via Cellebrite for Apple device images

2. ~3,400 electronic images from discs seized from Epstein's residences in 2019
   - Previously provided for review at MDC

3. ~7 hard copy nude images from FBI Florida Office investigation file
   - Never previously provided to defense

Key restriction: Because these images were classified as "obscene material," the FBI was not permitted to make duplicates. Only a single clean laptop was available for defense review at 500 Pearl Street.

B. Emails and Documents

Per EFTA00009802 and EFTA00016425:
- Over 1.1 million documents received in initial productions
- Emails and attachments were not linked in initial production (major failure)
- Load files had no link to native files
- Control numbers did not match native files
- Many files were too large to open in the Relativity viewer
- CDs from NY contained pictures only, no documents
- "Terabytes worth of data" across all devices

C. Epstein iPhone NYCO24318 (1B71)

Per EFTA00030562, EFTA00029975:
- The black iPhone (IMEI 357201093322785) was produced as part of the Sixth Production in November 2020
- Final report with images was prepared for production
- This was the phone seized from Epstein upon arrest at Teterboro Airport on July 6, 2019

Cellebrite Processing Anomaly (EFTA00089804): Cellebrite extracted 205,000+ images that "all look empty" from iPhone 1B71. An analyst asked: "Is it possible that FBI removed some photos beforehand if they were cp?" Additionally, 1,107 emails were withheld as potentially privileged. The blank images could result from corrupted data, encrypted thumbnails, deleted images leaving empty placeholder files, or processing artifacts. The analyst's question about prior FBI removal is documented but unresolved.

D. iPads

Per EFTA00028481 and EFTA00018089:
- Subject line: "Epstein iphone/ipad privilege reviews"
- iPads were sent for unlocking (3 iPads per EFTA00037386)
- Data was extracted and sent for privilege review
- A separate drive was created containing data from "several of Epstein's phones and ipads"

E. Definitive FBI Accounting: March-July 2025 Evidence Review (DS9 Expansion)

In 2025, newly appointed FBI Director Patel and Deputy Director Bongino requested a complete accounting of all Epstein evidence from FBI NY field office. DS9 contains the resulting internal communications.

No Sexual Abuse Videos Found (EFTA00164742, March 21, 2025):
AUSA Maurene Comey's response to Director Patel and DD Bongino:

"There were no videos of any sexual abuse identified at any point in the investigation."
Over ONE MILLION images/videos reviewed. FBI had no legal authority to seize 2019 surveillance videos from residences.
Nude photos of victims -- "victims are alone in these photos." No males present.

Definitive Content Breakdown (EFTA00164897, July 10, 2025 Director's Call; EFTA00161426):

Victim Accusations Against Others (EFTA00164897): "Approximately 4-5 victims accused other adult men sexually abused them. There was not enough evidence to federally charge these individuals, so the cases were referred to local law enforcement." Also: "Approximately 4-5 victims accused other adult women to have taken part in sexual abuse (threesomes with the minor), including Epstein's girlfriend who was approximately 18-20 years of age at the time."

Evidence Items Seized: "sex toys, massage tables, framed photos, photo albums, thumb drives, hard drives, computers, tapes, CDs/DVDs, iPads, personal documents, notes, writing tablets/binders, clothing items, logbooks, contact lists, blueprints."

Evidence Custody (EFTA00164740, March 21, 2025): All evidence seized in the 50D (sex trafficking) and 90A (death investigation) cases remains in FBI custody. CART creates 2 bit-for-bit copies of all digital evidence.

Devices Still Under Review April 2025 (EFTA00164855): 6 years after seizure, device examination had not been fully completed.

DOJ Conclusions (EFTA00163550, July 2025): DOJ concluded "no incriminating client list," no evidence of blackmail. AG Bondi stated many videos "turned out to be child porn" and will "never be released. Never going to see the light of day." DOJ reviewed "more than 300 gigabytes of data."

F. Steve Bannon's iPhone (Cross-case discovery)

Per EFTA00025553, EFTA00030999:
- During the We Build the Wall (WBTW) case review, an FBI reviewer was examining Steve Bannon's iPhone 7 on Cellebrite
- Found an image of Trump and Ghislaine Maxwell on Bannon's phone
- Screenshot from Cellebrite was attached and flagged to the Epstein/Maxwell case team
- Government determined "no need to do anything with this one"

PART IV: MCC SURVEILLANCE SYSTEM -- DVR FORENSICS

Source: EFTA00017948-52, EFTA00023970-75, EFTA00039025 (OIG Report)

This is arguably the most critical forensic failure in the entire case.

The DVR System Architecture:

• 147 total cameras at MCC New York (EFTA00164855) -- total video data: 8.08 TB
• 128 cameras assigned to recording
• DVR 1: 16 hard drives, operational, data available 7/23 - 8/10/2019
• 2 camera angles of interest recorded to DVR 1
• DVR 2: 16 hard drives, CATASTROPHIC FAILURE
• System failure on 7/29/2019
• 2 hard drive failures on 8/8/2019 (2 days before Epstein's death)
• Only available video: 7/15 - 7/29/2019
• 3 of 4 camera angles of interest in the SHU recorded to DVR 2
• Sally port camera (elevator bank #1 and #2) on DVR 2

Timeline of DVR 2 Failure:

FBI Forensic Analysis of DVR 2 (EFTA00039025 - OIG Report):

"The FBI's Digital Forensics Analysis Unit in Quantico, Virginia, received MCC New York's DVR system on August 16, 2019, and began to conduct a forensic analysis of the system. According to FBI forensic reports, DVR 2 did not start successfully. The Digital Forensics Analysis Unit found that the system contained three faulty hard drives. The FBI forensic reports state that the three drives were repaired by an FBI Advanced Data Recovery Specialist, but the DVR was never able to be assembled successfully. The forensic reports further state that an FBI computer scientist and the Company 1 Technician reviewed the DVR 2 controller logs and found that there had previously been 'catastrophic disk failures' and no recordings would have been available after July 29, 2019."

Seized DVR 2 Hard Drives (FBI CART Evidence Logs):

Per EFTA00023970-75, individual collected item logs were created for each drive:

All documented as: "Submission of CART Evidence [number]: One (1) [make/model] from MCC Nice Vision DVR2 Surveillance System ([X] of 18)"

Result: The 3 of 4 cameras covering the SHU where Epstein died had NO recoverable recordings from after July 29, 2019. Per EFTA00164855: "Cameras in SHU not active at time of death."

Contraband Phone — Inmate Michael Thomas, NOT Epstein (EFTA00164855)

Device 1B46, previously listed in the CART inventory as an "EMTEC 16GB USB," was clarified in April 2025: it was actually a contraband phone belonging to Inmate Michael Thomas, not Epstein. An 80 GB Cellebrite report was generated, but nothing in the extraction related to Epstein.

Unmonitored Phone Call -- Night Before Death (EFTA00061927, EFTA00115642, EFTA00115744)

Multiple OIG interview transcripts document extensive questioning about an unmonitored phone call provided to Epstein on August 9, 2019 -- the night before his death:

"This call was done on an unmonitored line."
"It is extremely concerning why this call would have been placed, and why it would be done on an unmonitored line."
"All inmate phone calls are recorded. So, why would an employee go on their own and provide a phone call to an offender?"
"It could have potentially led to the incident, but we don't, we will never know."

A male answered the phone and it was "handed off." The investigation never identified who Epstein spoke with.

MCC Document Shredding -- Full Text (EFTA00068331)

FBI Crisis Intake memorandum, August 16, 2019 (6 days after Epstein's death):

"4-5 bags of shredded documents" produced by BOP After-Actions team.
Staff member said: "this isn't the first time I've had to do things like this."

Related documents: EFTA00078396 (OIG forwarding the shredding report), EFTA00092927 (USAO response: "Can we take a look at the dumpster ASAP?"), EFTA00089106 (internal research into 18 USC 1519 elements -- obstruction statute for document destruction). The urgency of the dumpster request and the 18 USC 1519 research indicates prosecutors took the shredding allegation seriously.

TRUSCOPE Count Failures (EFTA00039972, EFTA00064553, EFTA00092920)

FD-302 interview confirming:

"There were no entries of counts in TRUSCOPE the entire night."
"If technology is down, the Correctional Officers also [are required to maintain manual counts]."

The 3:00 AM and 5:00 AM counts -- designed to "physically count and confirm each person in each cell" -- were not recorded. Combined with the DVR failure timeline, this establishes a near-complete surveillance gap in the SHU area on the night of Epstein's death. (DVR 1, covering other areas of MCC including 2 camera angles of interest, remained operational.)

PART V: THE 2005 PALM BEACH COMPUTER -- UNSEARCHED

Source: EFTA00015823 -- Letter from U.S. Attorney (April 9, 2021)

16 DVD-R discs were found in the FBI Florida Office's file, described as:

"Palm Beach County Sheriff's Office Case # 05-250067 Epstein EnCase Files Palm Beach PD DVD-R for General VERBATIM DVD Computer Crimes Unit"

Each disc labeled "Disk 1 of 16" through "Disk 16 of 16."

What happened:
1. When FBI NY first received the Florida file, agents could not open the files and believed they were inoperable
2. The Government later discovered the files were consistent with a forensic image of a computer (EnCase format)
3. An FBI computer specialist confirmed: the discs contain a forensic image of a computer seized from Epstein's Palm Beach residence in ~2005
4. The 2005 search warrant authorized seizure but did NOT authorize searching the contents of electronic devices
5. No subsequent warrant was ever obtained by local or federal authorities
6. The Government stated it had no lawful basis to review the forensic image
7. The Government stated it did not intend to obtain a warrant to search it
8. The Government could not permit defense to review the contents either
9. Epstein's estate was "repeatedly unwilling to waive any attorney-client privileges" regarding devices

This means a complete forensic image of Epstein's computer from 2005 -- the peak period of his abuse -- has never been examined by federal authorities. (Note: The Palm Beach County Sheriff's Office Computer Crimes Unit created the EnCase image and may have conducted local examination, possibly including in connection with the 2006 grand jury — but this is not addressed in the federal documents.)

PART VI: EVIDENCE HANDLING FAILURES & CHAIN OF CUSTODY GAPS

A. Massive Delays in Processing (Feb 2020 - Nov 2020)

The email chain in EFTA00009802, 00009941, 00016180, 00016425, 00032065 documents a saga of dysfunction:

B. Data Format Failures

Per EFTA00009802:

"The data we've received has no way to put any emails and attachments together. So if an email says, 'see the attached flight records,' for example, we have no way of linking that up with the records themselves."

"The load file has no link to the native file, so when we load the data to the database, there's no way to have the native files show up in the database."

"The control numbers in the load file don't match up to the native files. So we have two sets of numbers and no way to match up anything."

C. FBI vs. USAO Methodology Conflict

Per EFTA00016425 (FBI CART Coordinator):

"Just to be clear. The US Attorney's Office (or its contractors) are not 'processing' anything. You are taking files that I will be extracting from processed evidence and putting them into an E-Discovery tool (Relativity) to do a taint review. Relativity is NOT a forensic tool. It is incapable of dealing with many things that are found forensically on a computer like free space, slack space, and system files to name a few."

"Sorry it has taken so long, but we are talking about terabytes worth of data over multiple forms of digital evidence. Phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers. We have gotten past encryption on multiple devices."

D. Encryption Challenges

Per EFTA00037386, EFTA00016425:
- 3 iPads sent for unlocking
- 1 iPhone sent for unlocking
- 1 iMac locked and not able to be imaged
- 1 external hard drive imaged but encrypted
- "We have gotten past encryption on multiple devices"

E. Missing / Incomplete Device Data

Devices with known issues:
1. NYCO24342 -- Folders empty, no images/videos extracted
2. NYCO24376-380 -- Drives still being processed months after seizure
3. NYCO27913 -- Listed as provided on 7/23 but NOT on the disc
4. 2 servers -- Multiple drives physically failed; sent to HQ for recovery; outcome unknown
5. 3 iPads and 1 iPhone -- Sent for unlocking; status unclear
6. 1 iMac -- Locked, unable to be imaged
7. 71,000+ zero-byte files in initial 7 devices
8. Email attachments disconnected from parent emails in forensic tool

PART VII: CAIR SYSTEM AND EVIDENCE ACCESS

Source: EFTA00037676, EFTA00037686

The FBI maintained evidence access through the CAIR (Case and Analysis Information Repository) system:

"All the devices and media have been available through our CAIR system for over a year. I suggest you review through that system. I have already given several people access to those machines."

Additional personnel were granted CAIR access for evidence review:
- Multiple FBI agents added to CART evidence review for JE (EFTA00037686)
- SDNY was expected to review some devices while FBI reviewed the remaining balance
- "All the additional exports with the exception of 6 machines have been completed"

PART VIII: DISCOVERY PRODUCTION TO DEFENSE / MDC

A. Maxwell's Limited Access

Per EFTA00021015, EFTA00013222:
- Maxwell was provided a laptop computer at MDC for discovery review
- She was initially given access only on weekdays
- The prison computer was incapable of reading: native files, Excel files, some video/audio, and anything requiring Cellebrite software
- Defense argued Maxwell needed weekend and holiday access to review "millions of pages of discovery"
- She lost "10 or more hours per week" due to laptop delivery delays and MDC computer problems

B. Hard Drive Delivery to MDC

Per EFTA00016292, EFTA00023962, EFTA00026711, EFTA00026713:
- Multiple email chains regarding "delivery of hard drive to MDC for discovery production to inmate"
- Hard drives with loaded discovery needed to be non-encrypted (no password) for MDC delivery
- MDC required drives to go through their own processing before inmate access
- Government was "not permitted to send a drive that our IT department did not load" to MDC

C. Highly Confidential Evidence Review at 500 Pearl Street

Per EFTA00015738, EFTA00020322, EFTA00026890:
- ~2,100 images/videos could only be reviewed at 500 Pearl Street (FBI facility)
- Single laptop provided with Cellebrite software
- Images organized by source device folder
- FBI not permitted to make duplicates of "obscene material"
- Defense counsel attorneys (Laura Menninger, Jeff Pagliuca, Christian Everdell, Bobbi Sternheim) coordinated access

PART IX: RELATIVITY DATABASE MANAGEMENT

Source: Multiple EFTA documents (EFTA00019518, 19847, 21983, 22047, 29672, and many others)

The evidence was loaded into the Relativity e-Discovery platform under the case name "US v. Epstein":

• Database access: EFTA00019518 -- "We'd like to set up a Relativity database, please, for U.S. v. Epstein"
• Multiple databases existed: one for investigation materials, one for Maxwell discovery
• Tags system created for document management (EFTA00019847)
• Phone number searches conducted within Relativity (EFTA00024903)
• Defense discovery tasks coordinated through the Relativity databases (EFTA00021983)
• "FBI Files from Florida Office" folder contained 26,164 documents (EFTA00022047)
• Materials loaded in multiple batches with various production indices

EOUSA Relativity Login provided for FBI and SDNY access (EFTA01653704, 01653715, 01653721)

PART X: SEARCH WARRANT DOCUMENTATION

A. Original Device Search Warrants

• Draft SW for JE phone & iPad (EFTA00015561) -- July 14, 2019
• "Attached for review is a draft search warrant application for the phone and iPad that were seized from Epstein on the day of his arrest"
• SW 20 MAG 6719 (EFTA00022050) -- June 26, 2020
• Search warrant and supporting affidavit for Epstein devices responsiveness review
• Review protocol for image and video files created October 19, 2020

B. USVI / Little St. James Search

• FBI executed search warrant on Little St. James Island (referenced in EFTA01731021)
• USVI evidence included multiple servers with server racks, 25+ devices

C. Evidence Return

• EFTA01731021 references: "Return of Property to Frank Senerchia on 08/[date]"
• Some items returned to non-suspects after processing

PART XI: KEY PERSONNEL (Redacted but Identifiable by Role)

PART XII: PHYSICAL EVIDENCE PHOTOS (Image Analysis Database)

From the image catalog database, photographs of Epstein's residences captured the following digital devices in situ:

PART XIII: CRITICAL EVIDENCE GAPS AND UNRESOLVED QUESTIONS

1. The 2005 Palm Beach Computer

NEVER SEARCHED. 16 DVDs containing an EnCase forensic image of a computer seized from Epstein's Palm Beach home during the peak abuse period. No warrant was ever sought. Epstein's estate refused to waive privilege. This evidence remains unexamined.

2. The MCC DVR 2 Recordings

IRRECOVERABLE. Despite repairs by an FBI Advanced Data Recovery Specialist, DVR 2 containing footage from 3 of 4 SHU camera angles "was never able to be assembled successfully." The catastrophic disk failures pre-dating Epstein's death by 12 days meant no recordings existed from the cameras covering his cell after July 29, 2019.

3. Two Servers with Failed Drives

Two servers from the USVI seizure had physically failed drives requiring FBI HQ specialists. The examiner stated: "Since they are physically broken, data recovery may or may not be possible." The final outcome of this recovery effort is not documented in the files reviewed.

4. Six Unfinished Machine Exports

Per EFTA00037676 (Oct 2020): "All the additional exports with the exception of 6 machines have been completed." The status of these 6 machines is not resolved in the available documents.

5. Locked Apple Devices

At least 1 iMac that could not be imaged and 3 iPads + 1 iPhone sent for unlocking. Whether all were eventually unlocked is not clearly documented.

6. 71,000 Zero-Byte Files

The initial production of 7 devices contained approximately 71,000 empty files. The FBI CART examiner said this was "not unusual for the software to find such files" but the issue was flagged for further review. Whether these represented actual data loss is unclear.

7. NYCO24342 -- Empty Device

Device folders were completely empty. Whether this device genuinely contained no data or reflects an extraction failure is not documented.

8. NYCO27913 -- Missing from Disc

Listed on the evidence spreadsheet as provided on 7/23 but physically absent from the disc delivered. Disposition unclear.

9. Disconnected Email Attachments

The inability to link emails to their attachments in the initial 1.1 million document production means potentially critical evidence connections (e.g., "see the attached flight records") may have been missed during review.

10. 400 TB Deletion Order

The FBI CART team was ordered to "delete old stuff (about 400 TB worth)" during their network replacement. This appears to reference general FBI data management rather than Epstein evidence specifically.

11. Camera-in-Clock Practice -- 2003 Origin (EFTA00157526)

Palm Beach Police Department report from 2003 documents a burglary at 358 El Brillo Way (Epstein's Palm Beach residence). Epstein had purchased a spy camera from a store on Okeechobee Boulevard and concealed it "in a clock in his office" to catch a suspected thief. The camera successfully recorded the suspect at 4:28 AM with $4,000 in bait money involved. This is the earliest documented instance of Epstein's camera-in-clock practice -- 2 full years before the 2005 sex trafficking investigation. It establishes surveillance expertise, equipment procurement channels, and contextualizes the later contradiction between the FBI CID finding of "no cameras found in bedrooms" (EFTA00038617) and the Maxwell prosecution memo stating "Epstein had cameras in his clock" (EFTA02731226).

12. NARA Unauthorized Destruction Investigation (EFTA00172146)

In April 2025, the National Archives and Records Administration (NARA) investigated an ex-FBI agent whistleblower's claims that "people inside the FBI have been working night and day to destroy files on these servers." NARA contacted FBI's Information Management Division (IMD), which contacted INSD (Internal Security Division). INSD declined to investigate without more specific allegations. IMD hit a "dead end." OGC/CDC was to draft a response. This is the only documented federal investigation into potential evidence destruction -- and it was not pursued further after INSD declined to investigate without more specific allegations.

13. Senator Blackburn Evidence Request -- Unanswered (EFTA00161477, EFTA00161474)

Senator Marsha Blackburn sent a letter to Director Patel on February 24, 2025, requesting complete flight logs from Epstein's private jet and helicopter, any records in Maxwell's possession containing names of individuals, and additional items. FBI internal email from May 6, 2025: "Did we ever get the response?" -- "I did not." As of May 2025, the FBI had not responded to a sitting Senator's formal request for Epstein evidence -- 10 weeks after the letter was sent.

14. FBI Redaction of Trump Name (EFTA00163673)

Bloomberg reported that the FBI FOIA team "played a central role in redacting former President Donald Trump's name -- and the names of other high-profile individuals -- from the Epstein investigation files" using FOIA privacy exemptions.

APPENDIX A: DOCUMENT REFERENCE INDEX

Core Forensic Processing Documents:

• EFTA00009802 -- "FBI is completely fucking us" email; 60+ devices; 38 folders problem
• EFTA00009941 -- Device list request; COVID delays; "reduced to 1 day a week"
• EFTA00010440 -- 40 devices from NY + 60+ CDs + 25 USVI devices breakdown
• EFTA00013448 -- "Still some Apple items from NY that need to be produced"
• EFTA00016180 -- Updated item descriptions; serial number coordination
• EFTA00016425 -- "Relativity is NOT a forensic tool" + encryption discussion
• EFTA00016912 -- Hard drive from FBI CART for Relativity upload
• EFTA00020213 -- Detailed NYCO device list; 5 devices still pending
• EFTA00022331 -- Search warrant serial number requirements
• EFTA00029601 -- FBI Forensic Examiner 5-page CV (all certifications)
• EFTA00030562 -- Sixth Production; iPhone NYCO24318 finally produced
• EFTA00032065 -- Complete email chain showing processing timeline
• EFTA00037386 -- CART inventory: 3 iPads, 1 iPhone, 1 iMac locked, 1 encrypted HDD
• EFTA00037676 -- CAIR system; 6 machines still pending
• EFTA00037913 -- EpsteinNYEvidence.xlsx spreadsheet reference
• EFTA00038465 -- Master CART Evidence inventory with all 1B numbers

Cellebrite-Specific Documents:

• EFTA00015738 -- 2,100 images from devices; Cellebrite required for Apple
• EFTA00015786 -- Three categories of highly confidential images
• EFTA00020322 -- Cellebrite software provided on review drive
• EFTA00021015 -- Sternheim letter: MDC computer cannot run Cellebrite
• EFTA00025553 -- Bannon iPhone 7 reviewed on Cellebrite; Trump-Maxwell photo found
• EFTA00026890 -- Obscene material restrictions; single laptop for review
• EFTA00029601 -- Examiner's Cellebrite certifications (CCO + CCPA)
• EFTA00030999 -- Detailed Bannon/Cellebrite/Trump-Maxwell photo email

DVR / MCC Surveillance Documents:

• EFTA01649190 -- DVR system architecture: 192 cameras, 2 DVR systems, 16 HDs each
• EFTA00017948 -- DVR Update: password obtained, DVR 2 not running
• EFTA00017949 -- Download complete: priority cameras from DVR 1
• EFTA00017950 -- MCC Video Extraction technical update
• EFTA00017952 -- 302 for seized hard drives from MCC (DVR 2)
• EFTA00023970-75 -- Individual collected item logs for DVR 2 hard drives (with S/Ns)
• EFTA00039025 -- OIG Report: catastrophic disk failures, DFAU Quantico analysis

2005 Palm Beach Computer:

• EFTA00015823 -- Government letter: 16 EnCase DVDs never searched; no legal authority

Discovery Production / MDC:

• EFTA00013222 -- Defense complaint: government not complying with discovery
• EFTA00016292 -- Hard drive delivery to MDC logistics
• EFTA00021015 -- Sternheim letter to Judge Nathan re: laptop access
• EFTA00022050 -- Image/Video File Review Protocol with search warrant attachments

Evidence Access / CAIR:

• EFTA00037676 -- "All devices available through CAIR for over a year"
• EFTA00037686 -- Adding personnel to CART/CAIR for JE evidence review
• EFTA01683907-29 -- CAIR Review 90A-NY-3151227 (case number)

APPENDIX B: TIMELINE OF KEY FORENSIC EVENTS

Report compiled: 2026-02-07 | Updated 2026-02-12 with DS9/DS11 full corpus findings (1,380,937 documents)
Databases searched: 4 primary databases + full_text_corpus.db
Key updates: March-July 2025 FBI evidence review (no sex abuse videos, 15-20 commercial CSAM, 85 GB responsive), camera-in-clock 2003 origin, MCC 147 cameras/8.08 TB, contraband phone = Inmate Thomas, iPhone 205K blank images, MCC shredding full text, unmonitored phone call Aug 9, NARA destruction investigation, Senator Blackburn request unanswered, DOJ 2025 conclusions, FBI Trump name redaction