Corrupted PDF Recovery — Epstein Files Dataset 9

Overview

Five files in Dataset 9 (DS9) were identified as corrupted or non-standard PDFs that could
not be processed by normal PDF tools (PyMuPDF, Poppler, Ghostscript). Forensic analysis
revealed that none of these are simply corrupted PDFs — they are disk image fragments,
truncated scans, and files with other data types saved with .pdf extensions during the
forensic imaging process.

All five files were analyzed byte-by-byte, and all recoverable content has been extracted.

File Inventory

EFTA00645624 — Sharp Scanner Fax (FULLY RECOVERED)

Content: Legal memorandum dated April 22, 2015, from W. Chester Brewer Jr. to Jeffrey Epstein,
Darren Indyke, Jack Goldberger, and others. RE: Jeffrey Epstein vs. Scott Rothstein, Bradley J.
Edwards, et al. — 15th Judicial Circuit Case No. 502009CA040800XXXXMB. Concerns a UMC hearing
about motion for fees/costs.

Recovered files:
- EFTA00645624_decoded.png — Full-resolution page image (1704x2196 px, bilevel)
- EFTA00645624.tiff — Raw TIFF with CCITT data
- EFTA00645624_ocr.txt — Full OCR text
- EFTA00645624_ccitt_raw.bin — Raw CCITT Group 4 bitstream (31,992 bytes)

Recovery technique:
1. Parsed PDF objects manually (no xref available)
2. Located image object 6 with /Filter/CCITTFaxDecode /DecodeParms<</K -1/Columns 1704/Rows 2196>>
3. Extracted 31,992 bytes of raw CCITT Group 4 data
4. Constructed TIFF header: little-endian, 1704x2196, 1-bit, CCITT Group 4 compression
5. Opened with PIL, converted to PNG
6. OCR'd with Tesseract

EFTA01175426 — Faxed Court Order (FULLY RECOVERED, 10 of 11 pages)

Content: San Mateo County Superior Court probate order — "Order Approving Modification
of Trust." Involves the Elisa Zaffaroni irrevocable trust (dated April 15, 1989), trustee succession
rules, J.P. Morgan Trust Company as corporate co-trustee, and a $4.1 million principal distribution
for a Tiburon, CA residence. References David Packard, Esq. (attorney for the Zaffaroni family conservatorship) and the Zaffaroni family. Faxed from
"Academic Affairs" at 972-883-6764 (UT Dallas area code), dated March 22, 2012/2014.

Recovered files:
- EFTA01175426_page02.png through _page20.png — 10 page images (1728x2203 px, bilevel)
- EFTA01175426_full_ocr.txt — Full OCR text of all pages
- EFTA01175426_repaired.pdf — Repaired PDF with recovered pages

Recovery technique:
1. PyMuPDF, Ghostscript, and pdftoppm all failed (truncated xref)
2. Regex-scanned file for all /Subtype/Image objects with CCITTFaxDecode parameters
3. Found 10 image objects with consistent params: W=1728, H=2203, K=0 (Group 3), Cols=1728, EndOfBlock=false
4. For each: extracted raw stream data, built TIFF header with Group 3 1-D compression, decoded with PIL
5. Note: Page 1 (title page) and page 11 may be in the missing ~10KB truncated section

EFTA01220934 — Forensic Disk Image Fragment (FULLY CARVED)

Content: This is NOT a document. It is a fragment of a forensic disk image (~279 sectors of
4096 bytes) containing miscellaneous files from a Windows computer. The content is a mix of:
- Cached web page images (partially recovered due to sector fragmentation)
- Macromedia Dreamweaver and AutoCAD application files
- Windows system manifests (IE Extension Compatibility, MSAuditEvtLog)
- An Adobe license agreement in Czech
- An Apple Interface Builder plist from a music application
- Apple macOS codec descriptions (GSM, MPEG-4)

The JPEGs show the classic "top half recovered, bottom half garbage" pattern — this is because
each JPEG spans multiple disk sectors, but only the first contiguous run of sectors was captured.
The rest of each JPEG's data was in sectors belonging to other files on the original disk.

Recovered files:
- EFTA01220934_jpeg1.jpg through _jpeg9.jpg — 9 JPEGs carved from disk (2 corrupted, 7 viewable)
- jpeg2: Small thumbnail (160x120), woman with goggles (scientist/lab worker?)
- jpeg4: Sky icon (160x44)
- jpeg5: Low-res stamped document (160x44)
- jpeg6: Small fragment (264x197), pink/blue image
- jpeg7: Harlequin Presents poster — "Heidi Rice" (480x360) — romance novel cover
- jpeg8: Image of money/currency (286x384)
- jpeg9: Tall image (532x922)
- jpeg1, jpeg3: Corrupted (cannot be opened)
- EFTA01220934_gif1.gif — Office/application icons (344x280)
- EFTA01220934_png1.png — Tiny icon (9x9)
- EFTA01220934_png2.png — Small icon (38x12)
- EFTA01220934_content.html — Macromedia Dreamweaver tag library dialog (not case-relevant)
- EFTA01220934_content.rtf — Browser Extended Validation certificate help text (not case-relevant)

Sector map (each character = 4096 bytes):

P = PDF header, O = PDF object, J = JPEG, G = GIF, I = PNG, R = RTF, H = HTML
B = Apple PLIST, # = compressed data, ~ = medium entropy, - = low entropy
. = null, n = mostly null

P-#~#~--------------------G#####IJ#####---n..#n..#####nJJ-R-RR##
#####~###n##J##J##~~~~~##~~~~##~~###~~#~##~###--------~-#B-###n#
#####~#~~######################J##~####J###################---##
######H#--#####################H~#n~~I###.#--#..............n...
............nH--~~~~n--

Recovery technique:
1. Identified file as disk image via file command and absence of valid PDF structure
2. Scanned for file magic signatures: JPEG (FFD8FF), PNG (89504E47), GIF (47494638), RTF ({\rtf), HTML (