Report Index Record

evidence/DEVICE_FORENSICS_COMPLETE

COMPLETE DIGITAL DEVICE FORENSICS ANALYSIS

evidence

DEVICE_FORENSICS_COMPLETE.md

/reports/evidence/DEVICE_FORENSICS_COMPLETE.html

88

["EFTA00017948", "EFTA00000017", "EFTA00164897", "EFTA00028481", "EFTA00000290", "EFTA00024903", "EFTA00115642", "EFTA00064553", "EFTA00163550", "EFTA00037386", "EFTA00013448", "EFTA00000026", "EFTA00164742", "EFTA00015738", "EFTA00023970", "EFTA00015561", "EFTA00015786", "EFTA00021983", "EFTA00013222", "EFTA00018089", "EFTA00021015", "EFTA00017949", "EFTA01683907", "EFTA00015823", "EFTA00026713", "EFTA00030035", "EFTA00038465", "EFTA00000164", "EFTA00030999", "EFTA00161474", "EFTA00019518", "EFTA00037913", "EFTA01731021", "EFTA00161477", "EFTA00092920", "EFTA00000016", "EFTA00029975", "EFTA02731226", "EFTA00000277", "EFTA01649190", "EFTA00164855", "EFTA00092927", "EFTA00089804", "EFTA00029601", "EFTA00009802", "EFTA00172146", "EFTA00016912", "EFTA00025553", "EFTA00000147", "EFTA00000146", "EFTA00163673", "EFTA00039025", "EFTA00022050", "EFTA00037676", "EFTA00009941", "EFTA00019847", "EFTA00115744", "EFTA00000015", "EFTA00016180", "EFTA00038617", "EFTA00061927", "EFTA00157526", "EFTA00032065", "EFTA00037686", "EFTA00000032", "EFTA00016292", "EFTA00068331", "EFTA00164740", "EFTA00000020", "EFTA00161426", "EFTA00039972", "EFTA00020322", "EFTA00078396", "EFTA00016425", "EFTA00026890", "EFTA00020213", "EFTA00000276", "EFTA00023962", "EFTA00000033", "EFTA00017950", "EFTA00030562", "EFTA00089106", "EFTA00010440", "EFTA00026711", "EFTA00017952", "EFTA00022331", "EFTA01653704", "EFTA00022047"]

["Defense Counsel", "Donald Trump", "Ghislaine Maxwell", "Jeffrey Epstein", "Laura Menninger", "Maurene Comey", "MICHAEL THOMAS", "Steve Bannon", "Sting", "U.S. Attorney", "Virginia", "Warden", "Christian Everdell", "Jeff Pagliuca", "Violent Crime", "Search Warrant", "Virgin Islands", "Review Protocol", "Palm Bea", "Law Enforcement", "Epstein Investigation", "Epstein Evidence", "Sexual Abuse", "Grand Jury", "Violent Crimes", "Epstein Arrest", "Paralegal Specialist", "Bobbi Sternheim", "Maxwell Cas", "Marc Fernich", "Expert Testimony"]

**Date:** 2026-02-07 **Databases searched:** primary document text database, Dataset 10 document text database, OCR text extraction database, image catalog database **Total unique EFTA documents analyzed:** 150+ **Search terms:** Cellebrite, EnCase, XRY, FTK, Blacklight, BERLA, forensic exam, CART, chain of custody, hard drive, iPhone, iPad, MacBook, encryption, seized device, CAIR, Relativity, di

COMPLETE DIGITAL DEVICE FORENSICS ANALYSIS Jeffrey Epstein DOJ Files -- Comprehensive Device, Evidence & Chain-of-Custody Report Date: 2026-02-07 Databases searched: primary document text database, Dataset 10 document text database, OCR text extraction database, image catalog database Total unique EFTA documents analyzed: 150+ Search terms: Cellebrite, EnCase, XRY, FTK, Blacklight, BERLA, forensic exam, CART, chain of custody, hard drive, iPhone, iPad, MacBook, encryption, seized device, CAIR, Relativity, digital evidence, DVR, NiceVision, server, data recovery --- EXECUTIVE SUMMARY The Epstein DOJ files reveal a forensic evidence operation of significant scope -- and significant processing dysfunction. Between July 2019 and late 2021, the FBI seized over 70 digital devices from Epstein's New York mansion (approximately 40 storage devices plus 60+ CDs) and his US Virgin Islands properties (25+ devices including multiple servers and server racks). The processing of this evidence was plagued by: 17+ months of delays between seizure and usable production to prosecutors Terabytes of data spanning phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers Encrypted devices that required specialized cracking Server hard drives that physically failed, requiring FBI HQ data recovery specialists 71,000+ zero-byte (empty) files in initial productions No standardized tracking system -- prosecutors could not match folders to devices Catastrophic DVR failures at MCC that destroyed surveillance footage from the night of Epstein's death A 2005 Palm Beach computer forensic image on 16 DVDs that was never searched due to lack of legal authority 2,100 nude/partially nude images from devices designated "Highly Confidential" The FBI CART examiner was reduced to 1 day per week during COVID, stretching timelines by "a factor of 5" Evidence review still ongoing as of April 2025 -- 6 years after seizure March-July 2025 FBI Evidence Review (DS9 expansion): Internal communications between Director Patel, DD Bongino, AUSAs, and FBI NY provide definitive FBI conclusions: No sexual abuse videos found -- ever (EFTA00164742): AUSA Comey explicitly stated to Director Patel and DD Bongino: "there were no videos of any sexual abuse identified at any point in the investigation." Over 1 million images/videos extracted from devices (EFTA00164897, EFTA00161426): ~34,000 marked responsive (85 GB), 15-20 CSAM images (commercial, not self-produced), ~90% adult pornography/erotica, ~9% generic images Camera-in-clock practice documented to 2003 (EFTA00157526): Palm Beach PD burglary report -- 2 years before the 2005 sex trafficking investigation MCC surveillance: 147 cameras, 8.08 TB (EFTA00164855): SHU cameras not active at time of death Epstein received an unmonitored phone call the night before his death (EFTA00061927): Recipient never identified --- PART I: COMPLETE SEIZED DEVICE INVENTORY Source: EFTA00038465 -- CART EVIDENCE (Jeffrey Epstein), Case 50D-NY-3027571 This is the master evidence log. Devices are catalogued by "1B" item numbers: A. NEW YORK MANSION SEIZURE (July 6, 2019 search warrant) Desktop Computers: 1B Item Description Notes --------- ------------- ------- 1B28 Silver Apple Desktop Computer with keyboard and mouse 1B41 HP Compaq Machine 1B42 Cube 9000 Siteserver (BLACK/SILVER) 1B43 Dell Machine 1B53 Apple Desktop Computer with keyboard and mouse 1B54 Apple Desktop Computer with keyboard and mouse 1B57 Gray Apple Desktop Computer with keyboard and mouse 1B59 MSI PC computer in a brown box 1B61 Dell Precision Tower 5810 1B70 Apple Desktop Computer Laptops: 1B Item Description Notes --------- ------------- ------- 1B62 Sony Vaio Laptop NYCO24336/24337 per search warrant 1B96 Toshiba Laptop with charger 1B97 HP laptop with charger, S/N CND81368V5 Phones & Tablets: 1B Item Description Notes --------- ------------- ------- 1B55 White Apple iPhone 5 (in cellophane) 1B67 Space Gray Apple iPad 1B68 Space Gray Apple iPad 1B69 Silver iPad - 64GB 1B71 Black iPhone, IMEI 357201093322785 NYCO24318; This is the critical Epstein iPhone 1B72 Silver iPad, S/N DLXQGM3KGMW3 Hard Drives & Storage: 1B Item Description Notes --------- ------------- ------- 1B29-1B37 9x Seagate Path/100 Hard Drives 1B38-1B39 2x Data Traveler 4GB USB (in cellophane) 1B40 Mentor Media 32GB USB (in cellophane) 1B44 Silicone Power Micro SD Adapter with 16GB SD Card 1B46 EMTEC 16GB USB 1B47 Blue EMTEC 16GB USB 1B48-1B51 4x Cruzer Guide 32GB USB NYCO24344-47 1B52 SPIEF 2014 Silver USB 1B56 Seagate Backup Plus Portable Drive - 1TB 1B60 Seagate Barracuda 7200 hard drive 80GB 1B73-1B74 2x Black Hard Drive Optical Media: 1B Item Description Notes --------- ------------- ------- 1B45 10 Assorted CDs 1B63 45 Assorted CDs 1B75 Two Blue Binders with 58 Discs inside 1B78 4 binders with 68 discs inside Recording Devices: 1B Item Description Notes --------- ------------- ------- 1B64 Sony BM-560 Recorder 1B65 Silver Olympus Recorder 1B66 Black Radio Shack Recorder Cameras: 1B Item Description Notes --------- ------------- ------- 1B58 Sony Camera with black case 1B99 Red Nikon camera B. USVI / LITTLE ST. JAMES ISLAND SEIZURE (August 2019 search warrant) Desktop Computers: 1B Item Description Notes --------- ------------- ------- 1B80 Mac Desktop labeled "Kitchen Mac" - grey First USVI device produced 1B85 Silver Mac Desktop with mouse/keyboard, S/N CO2NM1MOFY14 1B87 Silver Mac Desktop 1B98 Silver Desktop Mac with Keyboard 1B102 Silver MacBook Desktop with keyboard 1B107 Silver Mac desktop, Model A1312, S/N W804736DDAS 1B118 Silver Mac Desktop 1B21 Mac Desktop, S/N W89524CZPJ, Model A1312 Laptops: 1B Item Description Notes --------- ------------- ------- 1B81 Silver Mac Laptop labeled "JE BIG LAPTOP" in black bag "Black Bag" brand 1B82 Silver MacBook Pro, S/N CO2ZAMOGUQWOP Tablets: 1B Item Description Notes --------- ------------- ------- 1B83 Silver iPad Model A1567, S/N DMPQL25NGSYPY 1B84 Silver iPad Model A1567, S/N DMPQLIRMGSY, in case Other Apple: 1B Item Description Notes --------- ------------- ------- 1B103 Apple iPod Shuffle on watch band Servers & Networking: 1B Item Description Notes --------- ------------- ------- 1B15 HP Server with 4x 500GB drives, S/N MXQ3220187 1B16 Panasonic KX-TDE100, S/N KX-TDA0149LCCD005398 Telecom system 1B17 6 Bay with 146GB drives, S/N MXQ824A1R 1B109 Unifi Cloud Key, M/N UN-CK 1B111 Unifi Video NVR, M/N UVC-NVR-278 Network video recorder 1B112 Unifi Server Windows PCs: 1B Item Description Notes --------- ------------- ------- 1B19 HP Desktop Tower, S/N CNV7160050, Model 260-010 1B20 HP Tower, S/N CNV716004Y, Model 260-2010 1B22 Lenovo Tower, S/N MIO7YG6U 1B23 Lenovo Tower, S/N 153306G2UMJXEKGX 1B24 HP Tower, S/N CNV742213M3, Model 570-p056 Voice Recorder: 1B Item Description Notes --------- ------------- ------- 1B108 Olympus Digital Voice Recorder C. DEVICES SEIZED FROM EPSTEIN'S PERSON (July 6, 2019 arrest) Per EFTA00015561 and EFTA00028481: 1 iPhone (seized upon arrest at Teterboro Airport) -- Draft search warrant for "JE phone & iPad" 1 iPad (seized upon arrest) D. NYC CART NUMBER CROSS-REFERENCE From the evidence tracking emails (EFTA00022331, EFTA00020213, EFTA00032065): NYCO Number Device Type Serial / Identifier ------------- ------------- --------------------- NYCO24318 iPhone (1B71) IMEI 357201093322785 NYCO24323 Dell PowerEdge 1310 hard drive #1 NYCO24324 Dell PowerEdge 1310 hard drive #2 NYCO24328 [Additional device, added late] NYCO24336 Sony Vaio laptop / Fujitsu HDD #1 NYCO24337 Sony Vaio laptop / Fujitsu HDD #2 NYCO24339 Micro SD card NYCO24340 Flash Drive (generic) NYCO24341 Thumbdrive (Emtec) NYCO24342 Hard drive (loose) Empty -- no images/videos extracted NYCO24343 Verbatim thumbdrive NYCO24344-47 4x SanDisk Cruzer thumbdrives NYCO24348-50 3x Seagate IDE hard drives NYCO24351 Camera SD card NYCO24353-54 [Storage devices] NYCO24362 [Major device - 600,000+ items] NYCO24365-72 [Multiple devices] NYCO24376-380 [Drives still being processed as of July 2020] NYCO24383 [Device] NYCO24385,387,389,391,393 Desktop towers (held actual drives) Not separately tracked NYCO24388, 392 [Devices] NYCO24395 [Server drives -- multiple] NYCO27909 [Desktop tower] NYCO27910 [Added late -- row 96] NYCO27913 [Listed as provided 7/23 but missing from disc] Total estimated NYCO-numbered items: 70-80+ --- PART II: FORENSIC TOOLS USED Source: EFTA00029601 -- FBI Forensic Examiner Curriculum Vitae (5 pages) The lead FBI examiner was based at the FBI Computer Analysis Response Team (CART), 26 Federal Plaza, New York, NY 10278. This individual held the following forensic certifications and training relevant to the Epstein case: Forensic Software Tools: Tool Certification / Training Date ------ -------------------------- ------ Cellebrite / Secureview Cell Phone Forensics training (4 days, Salt Lake City) Feb 2009 Cellebrite Certified Operator & Certified Physical Analyst (5 days, Austin TX) March 2018 XRY Mobile Phone Examination (2 days, Kansas City) May 2009 EnCase Internet Processing (3 days, Chicago); EnCase Certification March 2010 / Feb 2008 FTK (Forensic Tool Kit) Boot Camp (3 days); FTK 3 (3 days, Dallas); Advanced FTK Lab (3 days); FTK III for Mac (3 days, San Diego) 2005-2012 Blacklight Mac forensics (2 days, NYPD Academy, NY) May 2014 BlackBag / Macintosh Forensics Forward Discovery (5 days); Black Bag Mac Forensics (5 days, San Diego) April 2009 / April 2018 BERLA Vehicle Forensics (5 days, Annapolis) March 2019 IACIS Windows Forensic Examiner (4 days, Orlando) May 2016 Linux forensics Virtual Forensics for Linux (5 days, Denver); Linux Command Line (3 days) March 2010 / June 2011 Live Capture (3 days, Baltimore) August 2010 Examiner Qualifications: FBI CART Basic Wintel Forensic Examiner (Oct 2006) PDA/Cell Phone Forensic Examiner (Dec 2007) EnCase Certification (Feb 2008) Macintosh Forensic Examiner (April 2009) Senior Forensic Examiner (Aug 2010) Over 1,000 pieces of computer media analyzed across 300+ cases since 2005 200+ search warrants / search and seizure operations participated in Expert testimony in SDNY and EDNY Federal Court Masters in Digital Forensics and Cyber Security, John Jay College (2015-2019) Additional Tools Used (referenced in documents): Relativity -- e-Discovery platform for evidence review (not a forensic tool) CAIR -- FBI evidence access/tracking system ImageScan -- FBI image review tool (examiner was instructor) DExT -- Digital Evidence eXploitation Toolkit (examiner was instructor) Cellebrite Usage in the Epstein Case: Per EFTA00020322 and EFTA00015786: Cellebrite was required to view images/videos seized from Apple devices Cellebrite software was provided on the review hard drive for defense counsel Images from Apple devices could not be viewed as thumbnails; required Cellebrite The prison computer (MDC) was incapable of running Cellebrite (per EFTA00021015), meaning Maxwell could not review Apple device evidence on weekends/holidays --- PART III: WHAT WAS FOUND ON THE DEVICES A. Nude / Partially Nude Images (Highly Confidential) Per EFTA00015738, EFTA00015786, EFTA00020322, EFTA00030035: Three categories of images designated "Highly Confidential": ~2,100 electronic images and videos seized from Epstein's electronic devices Never previously provided to defense until March 2021 Separated by folder to indicate which device each image was seized from For "carved or deleted" images, no metadata was recovered Viewable only via Cellebrite for Apple device images ~3,400 electronic images from discs seized from Epstein's residences in 2019 Previously provided for review at MDC ~7 hard copy nude images from FBI Florida Office investigation file Never previously provided to defense Key restriction: Because these images were classified as "obscene material," the FBI was not permitted to make duplicates. Only a single clean laptop was available for defense review at 500 Pearl Street. B. Emails and Documents Per EFTA00009802 and EFTA00016425: Over 1.1 million documents received in initial productions Emails and attachments were not linked in initial production (major failure) Load files had no link to native files Control numbers did not match native files Many files were too large to open in the Relativity viewer CDs from NY contained pictures only, no documents "Terabytes worth of data" across all devices C. Epstein iPhone NYCO24318 (1B71) Per EFTA00030562, EFTA00029975: The black iPhone (IMEI 357201093322785) was produced as part of the Sixth Production in November 2020 Final report with images was prepared for production This was the phone seized from Epstein upon arrest at Teterboro Airport on July 6, 2019 Cellebrite Processing Anomaly (EFTA00089804): Cellebrite extracted 205,000+ images that "all look empty" from iPhone 1B71. An analyst asked: "Is it possible that FBI removed some photos beforehand if they were cp?" Additionally, 1,107 emails were withheld as potentially privileged. The blank images could result from corrupted data, encrypted thumbnails, deleted images leaving empty placeholder files, or processing artifacts. The analyst's question about prior FBI removal is documented but unresolved. D. iPads Per EFTA00028481 and EFTA00018089: Subject line: "Epstein iphone/ipad privilege reviews" iPads were sent for unlocking (3 iPads per EFTA00037386) Data was extracted and sent for privilege review A separate drive was created containing data from "several of Epstein's phones and ipads" E. Definitive FBI Accounting: March-July 2025 Evidence Review (DS9 Expansion) In 2025, newly appointed FBI Director Patel and Deputy Director Bongino requested a complete accounting of all Epstein evidence from FBI NY field office. DS9 contains the resulting internal communications. No Sexual Abuse Videos Found (EFTA00164742, March 21, 2025): AUSA Maurene Comey's response to Director Patel and DD Bongino: "There were no videos of any sexual abuse identified at any point in the investigation." Over ONE MILLION images/videos reviewed. FBI had no legal authority to seize 2019 surveillance videos from residences. Nude photos of victims -- "victims are alone in these photos." No males present. Definitive Content Breakdown (EFTA00164897, July 10, 2025 Director's Call; EFTA00161426): Category Amount Percentage ---------- -------- ------------ Total images/videos extracted from devices 1,000,000+ 100% Marked responsive ~34,000 ~3.4% Highly Responsive Material 85 GB -- CSAM (commercial, NOT self-produced) 15-20 images "The FBI's Digital Forensics Analysis Unit in Quantico, Virginia, received MCC New York's DVR system on August 16, 2019, and began to conduct a forensic analysis of the system. According to FBI forensic reports, DVR 2 did not start successfully. The Digital Forensics Analysis Unit found that the system contained three faulty hard drives. The FBI forensic reports state that the three drives were repaired by an FBI Advanced Data Recovery Specialist, but the DVR was never able to be assembled successfully. The forensic reports further state that an FBI computer scientist and the Company 1 Technician reviewed the DVR 2 controller logs and found that there had previously been 'catastrophic disk failures' and no recordings would have been available after July 29, 2019." Seized DVR 2 Hard Drives (FBI CART Evidence Logs): Per EFTA00023970-75, individual collected item logs were created for each drive: NYCO Number Description Serial Number Date Collected ------------- ------------- --------------- ---------------- NYC023578 Seagate Barracuda 500GB HDD, ST500DM002 S/N Z3T6CJJA 08/10/2019 4:30 PM NYC023579 Hitachi 500GB HDD, HDS721050CLA662 S/N JP1572JE36A13K 08/10/2019 4:30 PM NYC023580 Seagate Barracuda 500GB HDD, ST500DM002 S/N Z3T6CFSX 08/10/2019 4:30 PM NYC023582 Hitachi 500GB HDD, HDS721050CLA662 S/N JP1572JE36MWNK 08/10/2019 4:30 PM NYC023583 Seagate Barracuda 500GB HDD, ST3500320NS S/N 9QMBEC75 08/10/2019 4:30 PM All documented as: "Submission of CART Evidence [number]: One (1) [make/model] from MCC Nice Vision DVR2 Surveillance System ([X] of 18)" Result: The 3 of 4 cameras covering the SHU where Epstein died had NO recoverable recordings from after July 29, 2019. Per EFTA00164855: "Cameras in SHU not active at time of death." Contraband Phone — Inmate Michael Thomas, NOT Epstein (EFTA00164855) Device 1B46, previously listed in the CART inventory as an "EMTEC 16GB USB," was clarified in April 2025: it was actually a contraband phone belonging to Inmate Michael Thomas, not Epstein. An 80 GB Cellebrite report was generated, but nothing in the extraction related to Epstein. Unmonitored Phone Call -- Night Before Death (EFTA00061927, EFTA00115642, EFTA00115744) Multiple OIG interview transcripts document extensive questioning about an unmonitored phone call provided to Epstein on August 9, 2019 -- the night before his death: "This call was done on an unmonitored line." "It is extremely concerning why this call would have been placed, and why it would be done on an unmonitored line." "All inmate phone calls are recorded. So, why would an employee go on their own and provide a phone call to an offender?" "It could have potentially led to the incident, but we don't, we will never know." A male answered the phone and it was "handed off." The investigation never identified who Epstein spoke with. MCC Document Shredding -- Full Text (EFTA00068331) FBI Crisis Intake memorandum, August 16, 2019 (6 days after Epstein's death): "4-5 bags of shredded documents" produced by BOP After-Actions team. Staff member said: "this isn't the first time I've had to do things like this." Related documents: EFTA00078396 (OIG forwarding the shredding report), EFTA00092927 (USAO response: "Can we take a look at the dumpster ASAP?"), EFTA00089106 (internal research into 18 USC 1519 elements -- obstruction statute for document destruction). The urgency of the dumpster request and the 18 USC 1519 research indicates prosecutors took the shredding allegation seriously. TRUSCOPE Count Failures (EFTA00039972, EFTA00064553, EFTA00092920) FD-302 interview confirming: "There were no entries of counts in TRUSCOPE the entire night." "If technology is down, the Correctional Officers also [are required to maintain manual counts]." The 3:00 AM and 5:00 AM counts -- designed to "physically count and confirm each person in each cell" -- were not recorded. Combined with the DVR failure timeline, this establishes a near-complete surveillance gap in the SHU area on the night of Epstein's death. (DVR 1, covering other areas of MCC including 2 camera angles of interest, remained operational.) --- PART V: THE 2005 PALM BEACH COMPUTER -- UNSEARCHED Source: EFTA00015823 -- Letter from U.S. Attorney (April 9, 2021) 16 DVD-R discs were found in the FBI Florida Office's file, described as: "Palm Beach County Sheriff's Office Case # 05-250067 Epstein EnCase Files Palm Beach PD DVD-R for General VERBATIM DVD Computer Crimes Unit" Each disc labeled "Disk 1 of 16" through "Disk 16 of 16." What happened: When FBI NY first received the Florida file, agents could not open the files and believed they were inoperable The Government later discovered the files were consistent with a forensic image of a computer (EnCase format) An FBI computer specialist confirmed: the discs contain a forensic image of a computer seized from Epstein's Palm Beach residence in ~2005 The 2005 search warrant authorized seizure but did NOT authorize searching the contents of electronic devices No subsequent warrant was ever obtained by local or federal authorities The Government stated it had no lawful basis to review the forensic image The Government stated it did not intend to obtain a warrant to search it The Government could not permit defense to review the contents either Epstein's estate was "repeatedly unwilling to waive any attorney-client privileges" regarding devices This means a complete forensic image of Epstein's computer from 2005 -- the peak period of his abuse -- has never been examined by federal authorities. (Note: The Palm Beach County Sheriff's Office Computer Crimes Unit created the EnCase image and may have conducted local examination, possibly including in connection with the 2006 grand jury — but this is not addressed in the federal documents.) --- PART VI: EVIDENCE HANDLING FAILURES & CHAIN OF CUSTODY GAPS A. Massive Delays in Processing (Feb 2020 - Nov 2020) The email chain in EFTA00009802, 00009941, 00016180, 00016425, 00032065 documents a saga of dysfunction: Date Event ------ ------- July-Aug 2019 Devices seized from NY mansion, USVI, and Epstein's person Nov 2019 First hard drive produced to prosecutors with 38 folders and no device attribution Feb 15, 2020 Prosecutors still cannot tell what they received: "it's basically impossible for us to keep track" Feb 24, 2020 Prosecutors create template spreadsheet requesting basic device tracking March 2, 2020 FBI CART delayed by network teardown: "they mandated we delete old stuff (about 400 TB worth)" March 9, 2020 AUSA writes: "Notwithstanding their many promises to us about quick and effective processing of the 60+ devices they seized, the FBI is completely fucking us on this." March 9, 2020 Production data has no email-attachment linking, no native file links, mismatched control numbers April 7, 2020 "This has been pending for almost two months and we still don't have a very basic list" May 8, 2020 FBI reduced to 1 day/week due to COVID; "things have been stretched out by a factor of 5" May 12, 2020 FBI CART warns: "Relativity is NOT a forensic tool. It is incapable of dealing with... free space, slack space, and system files" May 15, 2020 AUSA still needs serial numbers for search warrant; FBI provides updated descriptions May 29, 2020 FBI provides updated item descriptions; notes many thumb drives/SD cards lack external S/Ns June 1, 2020 AUSA: "I confess I'm having a hard time tracking the updates to this" June 23, 2020 FBI produces spreadsheet; internal staff "can't match up all the numbers with 1B numbers" July 7, 2020 "Everything with the exception of a couple of items are ready" July 23, 2020 FBI provides color-coded evidence status spreadsheet July 24, 2020 71,000 documents in initial 7 devices are zero bytes (empty files) July-Aug 2020 2 servers with physically failed drives sent to HQ for recovery Aug 2020 "Since they are physically broken, data recovery may or may not be possible. It can be a very long process." Oct 14, 2020 FBI confirms: "All the devices and media have been available through our CAIR system for over a year" Oct 15, 2020 Device NYCO24342 folders are empty -- no images/videos extracted Oct 15, 2020 Multiple devices still pending: NYCO24328, 24329, 24353, 24365, 24366, 24371, 24383 Nov 9, 2020 Sixth Production -- iPhone NYCO24318 finally produced Jan 27, 2021 Highly confidential responsive material (nude images) compiled from CART evidence B. Data Format Failures Per EFTA00009802: "The data we've received has no way to put any emails and attachments together. So if an email says, 'see the attached flight records,' for example, we have no way of linking that up with the records themselves." "The load file has no link to the native file, so when we load the data to the database, there's no way to have the native files show up in the database." "The control numbers in the load file don't match up to the native files. So we have two sets of numbers and no way to match up anything." C. FBI vs. USAO Methodology Conflict Per EFTA00016425 (FBI CART Coordinator): "Just to be clear. The US Attorney's Office (or its contractors) are not 'processing' anything. You are taking files that I will be extracting from processed evidence and putting them into an E-Discovery tool (Relativity) to do a taint review. Relativity is NOT a forensic tool. It is incapable of dealing with many things that are found forensically on a computer like free space, slack space, and system files to name a few." "Sorry it has taken so long, but we are talking about terabytes worth of data over multiple forms of digital evidence. Phones, tablets, loose media, cameras, DVRs, servers, laptops, and desktop computers. We have gotten past encryption on multiple devices." D. Encryption Challenges Per EFTA00037386, EFTA00016425: 3 iPads sent for unlocking 1 iPhone sent for unlocking 1 iMac locked and not able to be imaged 1 external hard drive imaged but encrypted "We have gotten past encryption on multiple devices" E. Missing / Incomplete Device Data Devices with known issues: NYCO24342 -- Folders empty, no images/videos extracted NYCO24376-380 -- Drives still being processed months after seizure NYCO27913 -- Listed as provided on 7/23 but NOT on the disc 2 servers -- Multiple drives physically failed; sent to HQ for recovery; outcome unknown 3 iPads and 1 iPhone -- Sent for unlocking; status unclear 1 iMac -- Locked, unable to be imaged 71,000+ zero-byte files in initial 7 devices Email attachments disconnected from parent emails in forensic tool --- PART VII: CAIR SYSTEM AND EVIDENCE ACCESS Source: EFTA00037676, EFTA00037686 The FBI maintained evidence access through the CAIR (Case and Analysis Information Repository) system: "All the devices and media have been available through our CAIR system for over a year. I suggest you review through that system. I have already given several people access to those machines." Additional personnel were granted CAIR access for evidence review: Multiple FBI agents added to CART evidence review for JE (EFTA00037686) SDNY was expected to review some devices while FBI reviewed the remaining balance "All the additional exports with the exception of 6 machines have been completed" --- PART VIII: DISCOVERY PRODUCTION TO DEFENSE / MDC A. Maxwell's Limited Access Per EFTA00021015, EFTA00013222: Maxwell was provided a laptop computer at MDC for discovery review She was initially given access only on weekdays The prison computer was incapable of reading: native files, Excel files, some video/audio, and anything requiring Cellebrite software Defense argued Maxwell needed weekend and holiday access to review "millions of pages of discovery" She lost "10 or more hours per week" due to laptop delivery delays and MDC computer problems B. Hard Drive Delivery to MDC Per EFTA00016292, EFTA00023962, EFTA00026711, EFTA00026713: Multiple email chains regarding "delivery of hard drive to MDC for discovery production to inmate" Hard drives with loaded discovery needed to be non-encrypted (no password) for MDC delivery MDC required drives to go through their own processing before inmate access Government was "not permitted to send a drive that our IT department did not load" to MDC C. Highly Confidential Evidence Review at 500 Pearl Street Per EFTA00015738, EFTA00020322, EFTA00026890: ~2,100 images/videos could only be reviewed at 500 Pearl Street (FBI facility) Single laptop provided with Cellebrite software Images organized by source device folder FBI not permitted to make duplicates of "obscene material" Defense counsel attorneys (Laura Menninger, Jeff Pagliuca, Christian Everdell, Bobbi Sternheim) coordinated access --- PART IX: RELATIVITY DATABASE MANAGEMENT Source: Multiple EFTA documents (EFTA00019518, 19847, 21983, 22047, 29672, and many others) The evidence was loaded into the Relativity e-Discovery platform under the case name "US v. Epstein": Database access: EFTA00019518 -- "We'd like to set up a Relativity database, please, for U.S. v. Epstein" Multiple databases existed: one for investigation materials, one for Maxwell discovery Tags system created for document management (EFTA00019847) Phone number searches conducted within Relativity (EFTA00024903) Defense discovery tasks coordinated through the Relativity databases (EFTA00021983) "FBI Files from Florida Office" folder contained 26,164 documents (EFTA00022047) Materials loaded in multiple batches with various production indices EOUSA Relativity Login provided for FBI and SDNY access (EFTA01653704, 01653715, 01653721) --- PART X: SEARCH WARRANT DOCUMENTATION A. Original Device Search Warrants Draft SW for JE phone & iPad (EFTA00015561) -- July 14, 2019 "Attached for review is a draft search warrant application for the phone and iPad that were seized from Epstein on the day of his arrest" SW 20 MAG 6719 (EFTA00022050) -- June 26, 2020 Search warrant and supporting affidavit for Epstein devices responsiveness review Review protocol for image and video files created October 19, 2020 B. USVI / Little St. James Search FBI executed search warrant on Little St. James Island (referenced in EFTA01731021) USVI evidence included multiple servers with server racks, 25+ devices C. Evidence Return EFTA01731021 references: "Return of Property to Frank Senerchia on 08/[date]" Some items returned to non-suspects after processing --- PART XI: KEY PERSONNEL (Redacted but Identifiable by Role) Role Affiliation Key Documents ------ ------------- --------------- NY CART Coordinator / Senior Forensic Examiner FBI New York, 26 Federal Plaza EFTA00029601 (CV), EFTA00009941, EFTA00016425, EFTA00037386 Assistant U.S. Attorney (Lead) SDNY EFTA00009802, EFTA00016425, EFTA00032065 (drove evidence demands) Paralegal Specialist USAO SDNY EFTA00030562 (production coordination) FBI Special Agent FBI NY Violent Crimes Task Force EFTA00017948-52 (DVR chain of custody) ITS/Forensic Examiner (FE) FBI EFTA01731021 (July 18, 2019 examination) Digital Forensics Analysis Unit FBI Quantico, VA EFTA00039025 (DVR 2 forensic analysis) Advanced Data Recovery Specialist FBI HQ EFTA00039025 (repaired faulty DVR drives) --- PART XII: PHYSICAL EVIDENCE PHOTOS (Image Analysis Database) From the image catalog database, photographs of Epstein's residences captured the following digital devices in situ: EFTA Number Location Device Observed ------------- ---------- ----------------- EFTA00000015 Residence office Desk with multiple computer monitors, keyboards, office supplies EFTA00000016 Residence White desk, large monitor setup on wall (multiple monitors) EFTA00000017 Residence office 4 large computer monitors mounted on wall, desk with keyboard/mouse/telephone EFTA00000020 Residence Black server rack with servers and networking devices, fire helmet on top EFTA00000026 Residence Suitcase, white desk with computer monitor/keyboard/mouse EFTA00000032 Residence Desk with computer monitor, keyboard EFTA00000033 Residence Desk with iMac, keyboard, mouse EFTA00000146 Residence Large wooden desk with computer, keyboard, mouse EFTA00000147 Residence Wooden desk with computer monitor, keyboard, mouse EFTA00000164 Massage room Massage table, cabinet with bottles (no digital devices) EFTA00000276 Closet Stack of DVDs or similar media, mannequin torsos EFTA00000277 Closet Stack of CDs, exercise equipment EFTA00000290 Residence Wooden desk with telephone and printer --- PART XIII: CRITICAL EVIDENCE GAPS AND UNRESOLVED QUESTIONS The 2005 Palm Beach Computer NEVER SEARCHED. 16 DVDs containing an EnCase forensic image of a computer seized from Epstein's Palm Beach home during the peak abuse period. No warrant was ever sought. Epstein's estate refused to waive privilege. This evidence remains unexamined. The MCC DVR 2 Recordings IRRECOVERABLE. Despite repairs by an FBI Advanced Data Recovery Specialist, DVR 2 containing footage from 3 of 4 SHU camera angles "was never able to be assembled successfully." The catastrophic disk failures pre-dating Epstein's death by 12 days meant no recordings existed from the cameras covering his cell after July 29, 2019. Two Servers with Failed Drives Two servers from the USVI seizure had physically failed drives requiring FBI HQ specialists. The examiner stated: "Since they are physically broken, data recovery may or may not be possible." The final outcome of this recovery effort is not documented in the files reviewed. Six Unfinished Machine Exports Per EFTA00037676 (Oct 2020): "All the additional exports with the exception of 6 machines have been completed." The status of these 6 machines is not resolved in the available documents. Locked Apple Devices At least 1 iMac that could not be imaged and 3 iPads + 1 iPhone sent for unlocking. Whether all were eventually unlocked is not clearly documented. 71,000 Zero-Byte Files The initial production of 7 devices contained approximately 71,000 empty files. The FBI CART examiner said this was "not unusual for the software to find such files" but the issue was flagged for further review. Whether these represented actual data loss is unclear. NYCO24342 -- Empty Device Device folders were completely empty. Whether this device genuinely contained no data or reflects an extraction failure is not documented. NYCO27913 -- Missing from Disc Listed on the evidence spreadsheet as provided on 7/23 but physically absent from the disc delivered. Disposition unclear. Disconnected Email Attachments The inability to link emails to their attachments in the initial 1.1 million document production means potentially critical evidence connections (e.g., "see the attached flight records") may have been missed during review. 400 TB Deletion Order The FBI CART team was ordered to "delete old stuff (about 400 TB worth)" during their network replacement. This appears to reference general FBI data management rather than Epstein evidence specifically. Camera-in-Clock Practice -- 2003 Origin (EFTA00157526) Palm Beach Police Department report from 2003 documents a burglary at 358 El Brillo Way (Epstein's Palm Beach residence). Epstein had purchased a spy camera from a store on Okeechobee Boulevard and concealed it "in a clock in his office" to catch a suspected thief. The camera successfully recorded the suspect at 4:28 AM with $4,000 in bait money involved. This is the earliest documented instance of Epstein's camera-in-clock practice -- 2 full years before the 2005 sex trafficking investigation. It establishes surveillance expertise, equipment procurement channels, and contextualizes the later contradiction between the FBI CID finding of "no cameras found in bedrooms" (EFTA00038617) and the Maxwell prosecution memo stating "Epstein had cameras in his clock" (EFTA02731226). NARA Unauthorized Destruction Investigation (EFTA00172146) In April 2025, the National Archives and Records Administration (NARA) investigated an ex-FBI agent whistleblower's claims that "people inside the FBI have been working night and day to destroy files on these servers." NARA contacted FBI's Information Management Division (IMD), which contacted INSD (Internal Security Division). INSD declined to investigate without more specific allegations. IMD hit a "dead end." OGC/CDC was to draft a response. This is the only documented federal investigation into potential evidence destruction -- and it was not pursued further after INSD declined to investigate without more specific allegations. Senator Blackburn Evidence Request -- Unanswered (EFTA00161477, EFTA00161474) Senator Marsha Blackburn sent a letter to Director Patel on February 24, 2025, requesting complete flight logs from Epstein's private jet and helicopter, any records in Maxwell's possession containing names of individuals, and additional items. FBI internal email from May 6, 2025: "Did we ever get the response?" -- "I did not." As of May 2025, the FBI had not responded to a sitting Senator's formal request for Epstein evidence -- 10 weeks after the letter was sent. FBI Redaction of Trump Name (EFTA00163673) Bloomberg reported that the FBI FOIA team "played a central role in redacting former President Donald Trump's name -- and the names of other high-profile individuals -- from the Epstein investigation files" using FOIA privacy exemptions. --- APPENDIX A: DOCUMENT REFERENCE INDEX Core Forensic Processing Documents: EFTA00009802 -- "FBI is completely fucking us" email; 60+ devices; 38 folders problem EFTA00009941 -- Device list request; COVID delays; "reduced to 1 day a week" EFTA00010440 -- 40 devices from NY + 60+ CDs + 25 USVI devices breakdown EFTA00013448 -- "Still some Apple items from NY that need to be produced" EFTA00016180 -- Updated item descriptions; serial number coordination EFTA00016425 -- "Relativity is NOT a forensic tool" + encryption discussion EFTA00016912 -- Hard drive from FBI CART for Relativity upload EFTA00020213 -- Detailed NYCO device list; 5 devices still pending EFTA00022331 -- Search warrant serial number requirements EFTA00029601 -- FBI Forensic Examiner 5-page CV (all certifications) EFTA00030562 -- Sixth Production; iPhone NYCO24318 finally produced EFTA00032065 -- Complete email chain showing processing timeline EFTA00037386 -- CART inventory: 3 iPads, 1 iPhone, 1 iMac locked, 1 encrypted HDD EFTA00037676 -- CAIR system; 6 machines still pending EFTA00037913 -- EpsteinNYEvidence.xlsx spreadsheet reference EFTA00038465 -- Master CART Evidence inventory with all 1B numbers Cellebrite-Specific Documents: EFTA00015738 -- 2,100 images from devices; Cellebrite required for Apple EFTA00015786 -- Three categories of highly confidential images EFTA00020322 -- Cellebrite software provided on review drive EFTA00021015 -- Sternheim letter: MDC computer cannot run Cellebrite EFTA00025553 -- Bannon iPhone 7 reviewed on Cellebrite; Trump-Maxwell photo found EFTA00026890 -- Obscene material restrictions; single laptop for review EFTA00029601 -- Examiner's Cellebrite certifications (CCO + CCPA) EFTA00030999 -- Detailed Bannon/Cellebrite/Trump-Maxwell photo email DVR / MCC Surveillance Documents: EFTA01649190 -- DVR system architecture: 192 cameras, 2 DVR systems, 16 HDs each EFTA00017948 -- DVR Update: password obtained, DVR 2 not running EFTA00017949 -- Download complete: priority cameras from DVR 1 EFTA00017950 -- MCC Video Extraction technical update EFTA00017952 -- 302 for seized hard drives from MCC (DVR 2) EFTA00023970-75 -- Individual collected item logs for DVR 2 hard drives (with S/Ns) EFTA00039025 -- OIG Report: catastrophic disk failures, DFAU Quantico analysis 2005 Palm Beach Computer: EFTA00015823 -- Government letter: 16 EnCase DVDs never searched; no legal authority Discovery Production / MDC: EFTA00013222 -- Defense complaint: government not complying with discovery EFTA00016292 -- Hard drive delivery to MDC logistics EFTA00021015 -- Sternheim letter to Judge Nathan re: laptop access EFTA00022050 -- Image/Video File Review Protocol with search warrant attachments Evidence Access / CAIR: EFTA00037676 -- "All devices available through CAIR for over a year" EFTA00037686 -- Adding personnel to CART/CAIR for JE evidence review EFTA01683907-29 -- CAIR Review 90A-NY-3151227 (case number) --- APPENDIX B: TIMELINE OF KEY FORENSIC EVENTS Date Event ------ ------- ~2005 Palm Beach PD seizes computer from Epstein residence; EnCase forensic image created on 16 DVDs July 6, 2019 Epstein arrested at Teterboro; iPhone and iPad seized from person July 6, 2019 Search warrant executed at 9 E. 71st Street (NY mansion) July 14, 2019 Draft search warrant for JE phone & iPad July 16, 2019 Marc Fernich requests return of personal effects; electronic devices retained per warrant July 18, 2019 ITS/Forensic Examiner begins work on devices July 29, 2019 MCC DVR 2 catastrophic disk failure Aug 9, 2019 FBI queries CART: "how many electronic items processed? analyzed? encrypted?" Aug 9, 2019 CART inventory: 3 iPads for unlock, 1 iPhone for unlock, 1 iMac locked, 1 HDD encrypted, 2 iMacs processed, 1 iMac pending, 2 Windows PCs processed, 1 laptop processed, loose media processed Aug 10, 2019 Epstein found dead Aug 10, 2019 DVR 2 hard drives seized at 4:30 PM Aug 14, 2019 DVR 1 priority camera footage downloaded; CART/MXU team on site Aug 16, 2019 DVR system shipped to FBI DFAU, Quantico Aug-Sept 2019 USVI search warrant executed on Little St. James Island Aug 29, 2019 First hard drive loaded to Relativity for privilege review Nov 2019 Hard drive produced with 38 folders; 1.1 million documents Feb 2020 Prosecutors unable to determine what data matches which devices March 9, 2020 "FBI is completely fucking us on this" email May 2020 COVID reduces FBI CART to 1 day/week May 12, 2020 FBI CART explains encryption progress; Relativity limitations May 29, 2020 Updated device descriptions with serial numbers provided July 23, 2020 Color-coded evidence status spreadsheet; servers with failed drives flagged Oct 2020 CAIR access confirmed; 6 machines still pending Oct 19, 2020 Image/Video File Review Protocol created Nov 9, 2020 Sixth Production: iPhone NYCO24318 produced Jan 27, 2021 Highly confidential responsive material compiled from CART evidence Feb 1, 2021 Sternheim letter re: MDC laptop access and Cellebrite March 16, 2021 Physical evidence spreadsheets provided to defense; 2,100 HC images April 9, 2021 Government letter: 2005 Palm Beach computer will NOT be searched June 2021 Trump-Maxwell photo found on Bannon iPhone 7 via Cellebrite review --- Report compiled: 2026-02-07 Updated 2026-02-12 with DS9/DS11 full corpus findings (1,380,937 documents) Databases searched: 4 primary databases + full_text_corpus.db Key updates: March-July 2025 FBI evidence review (no sex abuse videos, 15-20 commercial CSAM, 85 GB responsive), camera-in-clock 2003 origin, MCC 147 cameras/8.08 TB, contraband phone = Inmate Thomas, iPhone 205K blank images, MCC shredding full text, unmonitored phone call Aug 9, NARA destruction investigation, Senator Blackburn request unanswered, DOJ 2025 conclusions, FBI Trump name redaction