Report Index Record

evidence/PLIST_FORENSIC_SEARCH

PLIST FORENSIC SEARCH REPORT

evidence

PLIST_FORENSIC_SEARCH.md

/reports/evidence/PLIST_FORENSIC_SEARCH.html

87

["EFTA02323043", "EFTA02310713", "EFTA02317856", "EFTA00032465", "EFTA02584723", "EFTA02388589", "EFTA00432172", "EFTA02453274", "EFTA02700500", "EFTA00015804", "EFTA00015770", "EFTA00518756", "EFTA02323056", "EFTA00015738", "EFTA02299110", "EFTA00436223", "EFTA00015786", "EFTA00031332", "EFTA02522767", "EFTA02518909", "EFTA02300584", "EFTA00030035", "EFTA00415730", "EFTA00030999", "EFTA02323069", "EFTA00173373", "EFTA00511040", "EFTA02513964", "EFTA02518864", "EFTA02518872", "EFTA00164855", "EFTA00524160", "EFTA02570954", "EFTA02317855", "EFTA02570943", "EFTA02571050", "EFTA02323071", "EFTA02114558", "EFTA02513966", "EFTA00029601", "EFTA02317857", "EFTA02323093", "EFTA02570981", "EFTA01781767", "EFTA00025553", "EFTA02696356", "EFTA01793116", "EFTA02388553", "EFTA01758519", "EFTA02502971", "EFTA02518833", "EFTA02570971", "EFTA02518859", "EFTA01792918", "EFTA01774370", "EFTA02664944", "EFTA02362038", "EFTA02554183", "EFTA02303801", "EFTA00164740", "EFTA01802972", "EFTA01774075", "EFTA02406465", "EFTA02310703", "EFTA00020322", "EFTA00026890", "EFTA02589089", "EFTA00511023", "EFTA00422779", "EFTA00031589", "EFTA01524160", "EFTA02672124", "EFTA02518921", "EFTA01766832", "EFTA00030101", "EFTA02532947", "EFTA00015753", "EFTA02571051", "EFTA02317839", "EFTA02513976", "EFTA02672121", "EFTA02588573", "EFTA00032669", "EFTA02518841", "EFTA00511018", "EFTA01765156", "EFTA02351725"]

["Austin Hill", "Ben Goertzel", "Brune", "Clinton", "Eric Gany", "George Church", "Ghislaine Maxwell", "Jean Luc Brunel", "Jeffrey Epstein", "Karyna Shuliak", "Larry Visoski", "Lesley Groff", "Linda", "Martin Nowak", "Michael Ovitz", "Mort Zuckerman", "Nadia Marcinkova", "Nicole Junkermann", "Peggy Siegal", "Reid Hoffman", "Sara", "Sarah Kellen", "Steve Bannon", "Unnamed", "Woody Allen", "Ann Rodriquez", "Gary Siegal", "Morgan Chase", "Chase Ban", "Apple Mail"]

**Generated:** 2026-02-07 **Databases Searched:** The specific EFTA number `EFTA00524160` was NOT found in any of the four databases. However, a closely related number was found: **[EFTA01524160](https://www.justice.gov/epstein/files/DataSet%2010/EFTA01524160.pdf)** -- This document DOES exist: - Statement period: April 1, 2003 -- April 30, 2003

PLIST FORENSIC SEARCH REPORT Exhaustive Database Search for Apple Property List (PLIST) Content & EFTA00524160 Generated: 2026-02-07 Databases Searched: the primary document text database the Dataset 10 document text database the OCR text extraction database the image catalog database --- EFTA00524160 -- SEARCH RESULTS Finding: EFTA00524160 DOES NOT EXIST in any database. The specific EFTA number EFTA00524160 was NOT found in any of the four databases. However, a closely related number was found: EFTA01524160 -- This document DOES exist: File: DOJ dataset file dataset10/VOL00010/IMAGES/0135/EFTA01524160.pdf Content: JPMorgan Chase Private Bank statement for Ghislaine Maxwell Statement period: April 1, 2003 -- April 30, 2003 Account: Premier Checking, c/o New York Strategy Group, Attn: Eric Gany Opening balance: $3,499,315.96 Total credits: $3,991.98 Total debits: $23,745.79 Ending balance: $3,479,564.15 Private Bank Team: Maria Hornak Bates numbers: JPM-SDNY-00051945, SDNYGM00321143 Redaction analysis (v2 & ds10): 2 redactions detected, both classified as proper_redaction with low confidence (0.5051, 0.5609). Hidden text was empty (nothing recovered beneath redactions). Document summary: 2 total pages, 0 with recovered text, 2 redacted pages Assessment: EFTA01524160 is a financial document (bank statement), NOT a PLIST-encoded document. The caller may have had the wrong EFTA number, or the number may have been confused. This is a JPMorgan banking record, not Apple device data. --- PLIST CONTENT -- COMPREHENSIVE FINDINGS 2.1 Scope and Scale Database Metric Count ---------- -------- ------- OCR (OCR text extraction database) Distinct EFTA documents containing "plist" 268 OCR Documents with conversation-id + date-received metadata 358 OCR Documents with gmail-label-ids 296 OCR Documents with remote-id 459 OCR Documents with original-mailbox + IMAP references 38 Redaction analysis (v2) Distinct EFTA with plist in hidden (redacted) text 12 Redaction analysis (ds10) Distinct EFTA with plist (duplicates v2) 10 Total unique documents containing Apple PLIST metadata (OCR database only): approximately 460+ Revisit note (2026-02-12): The full text corpus (1,380,937 documents across all 12 datasets) reveals a scale approximately 200x larger than the OCR database captured: 93,634 documents with gmail-label-ids, 18,160 with original-mailbox references, and 84,401 with date-received + plist co-occurring. DS11 alone contains approximately 75,630 PLIST-containing documents. The OCR database captured less than 0.5% of the actual PLIST corpus. The 460+ figure below reflects only the OCR database subset. 2.2 What This Data Actually Is THIS IS NOT DEVICE BACKUP DATA. The PLIST content found across these documents represents Apple Mail (Mail.app) email metadata that was embedded within printed/exported emails. Specifically: The PLIST fragments are Apple Mail's internal message metadata, automatically appended when emails were exported from Mail.app or Apple's email system. The standard structure found is: conversation-id [ID] date-last-viewed 0 date-received [UNIX_TIMESTAMP] flags [FLAG_VALUE] gmail-label-ids [LABEL_ID] original-mailbox imap://[EMAIL_ACCOUNT]/[FOLDER] remote-id [MESSAGE_ID] 2.3 Email Accounts Identified in PLIST Metadata Email Account Description Document Count --------------- ------------- ---------------- [email protected] Jeffrey Epstein's primary Gmail ~683 in OCR DB; 272,735 in DS9 + 170,876 in DS11 (full corpus) [email protected] Sarah Kellen's Apple iCloud/Mac email 11 in OCR DB; 1,465 in DS9/DS11 (full corpus) [email protected] Sarah Kellen's transitional Apple email 39 in DS9 (full corpus; not found in OCR DB) The [email protected] account is forensically significant -- it reveals that Sarah Kellen's Mac computer running Apple Mail was used to access and export some of these emails. The IMAP mailbox references show folder paths like imap://[email protected]/Sent%20Messages. Revisit note (2026-02-12): DS9 also reveals the [email protected] transitional Apple domain, with 39 documents including flight coordination emails with Nadia Marcinkova (EFTA00415730: "330 wheels up WED the 11th from lsj to ny") and direct emails to Epstein (EFTA00422779). The total sarahk525 count expands from 11 to 1,465 documents across DS9/DS11. 2.4 Date Range of PLIST-Embedded Email Metadata Based on Unix timestamps extracted from date-received fields: Earliest: September 1, 2009 (timestamp 1251822309) Latest: October 5, 2018 (timestamp 1538761712) This spans approximately 9 years of email activity from 2009 to 2018. 2.5 Key Flag Values Observed Flag Value Meaning Frequency ------------ --------- ----------- 8590195713 Read message Most common 8623750145 Read + flagged/labeled message Common 8590195717 Read with additional flags Occasional 8590195969 Read with special flags Rare --- PLIST DATA IN REDACTED (HIDDEN) TEXT These 12 documents had PLIST content recovered from BENEATH redactions -- meaning the PLIST metadata was actively hidden by redaction overlays: Documents with PLIST Recovered from Redactions (primary document text database) EFTA Number Page Recovered Text Redaction Type Confidence ------------- ------ ---------------- ---------------- ------------ EFTA01758519 0 PLIST 1 0//EN" bad_overlay 0.7785 EFTA01765156 0 D PLIST 1 0//EN" bad_overlay 0.8014 EFTA01766832 0 li t PUBLIC " //A l //DTD PLIST 1 0//EN" "htt // l bad_overlay 0.99 EFTA01774075 0 bad_overlay 0.8825 EFTA02114558 1 Revisit note (2026-02-12): DS9 alone contains 21+ Cellebrite-referencing documents, expanding the total beyond the 17 identified in DS8. New DS9 documents include: EFTA00164855 (CART download of 80GB Cellebrite report from a contraband phone, April 2025); EFTA00173373 (FBI CACHTU inspection revealing Axiom, Cellebrite, and GrayKey purchased via UCO funds); and EFTA00164740 (March 2025 evidence review referencing CART/Cellebrite procedures). The following documents reference Cellebrite forensic extraction software: EFTA Number Content ------------- --------- EFTA00020322 KEY: "All electronic images should be viewable as thumbnails, except those seized from Apple devices, which must be viewed using Cellebrite. The Cellebrite software will be provided on the drive for your review of images and videos seized from Apple devices." EFTA00029601 FBI forensic examiner's CV: "Cellebrite/Secureview Cell Phone Forensics, Salt Lake City, UT (4 days)" training in Feb 2009, plus XRY Mobile Phone Examination, EnCase, Forward Discovery Macintosh Forensics EFTA00025553, EFTA00030999 "GM photo on Bannon phone" -- "I've been looking through Steve Bannon's iPhone 7 on Cellebrite. As I was going through the images from that phone, I found an image of Trump and Ghislaine Maxwell on Bannon's phone" EFTA00015786, EFTA00030035, EFTA00015804 Discovery letter: ~2,100 electronic images/videos seized from Epstein's electronic devices, ~3,400 from discs, 7 hard copy nude images from FBI Florida investigation EFTA00015738, EFTA00015753, EFTA00015770 Prosecution correspondence about evidence viewing procedures EFTA00026890 Defense question: "Can you please explain why 2,100 + 7 'highly confidential' images have not been shared with us yet?" EFTA00031332, EFTA00031589, EFTA00030101 Government responses about evidence handling EFTA00032465, EFTA00032669 Defense requests for evidence segregation 5.2 Key Forensic Finding: Apple Devices Required Cellebrite Per EFTA00020322, the government explicitly stated that images seized from Epstein's Apple devices required Cellebrite software to view. This confirms: Apple devices were seized from Epstein Cellebrite was used to extract data from these Apple devices The extracted data was provided to defense on hard drives 5.3 Steve Bannon's iPhone 7 Per EFTA00025553 and EFTA00030999, during a Cellebrite review of Steve Bannon's iPhone 7 (as part of an apparently separate "WBTW" case), an image of Trump and Ghislaine Maxwell was found on Bannon's phone. This cross-case discovery was flagged internally. --- SARAH KELLEN'S APPLE MAIL DATA Documents with [email protected] IMAP References These documents contain Apple Mail PLIST metadata with IMAP mailbox paths pointing to Sarah Kellen's .mac.com email, indicating these emails were exported from her Apple Mail application: EFTA Number Content ------------- --------- EFTA02299110 Email with original-mailbox: imap://[email protected]/Sent%20Messages EFTA02310703 Email with Sarah Kellen's IMAP mailbox reference EFTA02310713 "JE said we can cancel the hotel rooms in Menlo Park, CA... He's going to cancel the trip" + date-sent: 1340203692 (June 20, 2012) EFTA02317839 Email with Sarah Kellen's mailbox reference EFTA02317855 Email with Sarah Kellen's mailbox reference EFTA02317856 Email with Sarah Kellen's mailbox reference EFTA02317857 Email with Sarah Kellen's mailbox reference EFTA02323043 "any help/input would be appreciated! Thanks chica" + original-mailbox: imap://[email protected]/Sent%20Messages EFTA02323056 Email with Sarah Kellen's mailbox reference EFTA02323069 Email with Sarah Kellen's mailbox reference EFTA02323071 Email with Sarah Kellen's mailbox reference Forensic significance: The presence of imap://[email protected]/Sent%20Messages in the PLIST metadata proves these emails were stored in and exported from Sarah Kellen's Apple Mail account on a Mac computer. The .mac.com domain was Apple's pre-iCloud email service (later transitioned to @me.com and then @icloud.com). Sarah Kellen's Mac -- Property-Organized Email Folders (DS9 Expansion) Revisit addition (2026-02-12): EFTA00511040 (DS9) is a Cellebrite forensic extraction report for device NYCO24329 (Macintosh HD, AFF4 forensic image format). It reveals Kellen's complete Mac Mail folder structure organized by Epstein property: /Users/(Deleted)/Library/Mail/V2/Mac-sarahk525/Work.mbox/LSJ.mbox/ -- emails organized under Little Saint James island /Users/(Deleted)/Library/Mail/V2/Mac-sarahk525/Work.mbox/71st.mbox/ -- emails organized under the 71st Street Manhattan townhouse /Users/(Deleted)/Library/Mail/V2/MailData/Envelope Index -- master email database The account was marked (Deleted) -- the user profile had been deleted before forensic imaging, indicating attempted evidence destruction. The Work.mbox parent folder confirms these were treated as work-related communications. The same Macintosh (NYCO24329) also contained /Users/karyna/Library/Mail/V6/ -- Karyna Shuliak's user account, establishing a device continuity chain from NPA-protected co-conspirator (Kellen) to Epstein's later partner (Shuliak). EFTA00518756 shows top contacts analysis: sarahk525 had 22,524 messages with her top contact, 12,304 with the second, and 10,952 with the third. Skype Call Logs -- Device NYCO24329 (DS9 Expansion) Revisit addition (2026-02-12): EFTA00511018/EFTA00511023 (DS9): Cellebrite extraction from NYCO24329 includes complete Skype audio call logs spanning September 2012 through January 2014, with both incoming and outgoing calls documented. Many calls show "Cancelled" status. This provides an additional communication channel not previously documented. --- COMPLETE LIST OF EFTA NUMBERS WITH PLIST CONTENT 7.1 From OCR Database (268 unique documents) The full list of 268 EFTA numbers is extensive. Key EFTA ranges: EFTA02299110 - EFTA02300584 (early batch) EFTA02303801 - EFTA02323093 (Sarah Kellen batch) EFTA02351725 - EFTA02406465 (mid-range) EFTA02453274 - EFTA02502971 (later batch) EFTA02513964 - EFTA02571051 (largest batch -- Lesley Groff emails) EFTA02584723 - EFTA02700500 (latest batch) 7.2 From Redaction Analysis (12 unique documents, all with bad_overlay redactions) EFTA01758519, EFTA01765156, EFTA01766832, EFTA01774075, EFTA01774370 EFTA01781767, EFTA01792918, EFTA01793116, EFTA01802972 EFTA02114558, EFTA02522767, EFTA02696356 --- ASSESSMENT AND CONCLUSIONS 8.1 Nature of the PLIST Data The PLIST content found across these 460+ documents is Apple Mail internal message metadata, NOT: iPhone/iPad device backups Safari browsing history Contacts databases Location data App usage data The metadata was embedded because emails were exported from Apple Mail (Mail.app on macOS) in a format that included the internal PLIST representation. This happened because: The emails were printed or exported to PDF directly from Apple Mail Apple Mail's internal metadata (conversation-id, date-received, flags, gmail-label-ids, remote-id, original-mailbox) was included in the export The metadata was not stripped before the documents were produced in discovery 8.2 Forensic Value Despite not being device backup data, this PLIST metadata is still forensically valuable because: Email Account Identification: Confirms [email protected] (Epstein) and [email protected] (Kellen) as email accounts Precise Timestamps: Unix timestamps in date-received provide exact receipt times (to the second) for emails, independent of what the email header says Gmail Label IDs: The gmail-label-ids fields show how emails were categorized in Gmail, potentially revealing organizational patterns Conversation Threading: conversation-id values could be used to reconstruct email threads Remote Message IDs: remote-id values map to IMAP message IDs on the mail server Mail Client Identification: Proves Apple Mail was used (not just webmail) Folder Information: original-mailbox reveals which folder emails were filed in (e.g., Sent Messages) 8.3 Date Coverage The PLIST metadata timestamps in the OCR database cover email activity from September 2009 to October 2018 -- a 9-year window ending approximately 9 months before Epstein's arrest on July 6, 2019. With the full corpus, DS9 Cellebrite extractions provide device-level timestamps independent of email PLIST metadata, and the PLIST date range may extend further. 8.4 Redaction Failures 12 documents in dataset10 had PLIST content that was supposed to be redacted but was recoverable due to bad_overlay` redactions (high confidence 0.77-0.99). This suggests the redaction process did not properly handle the XML/PLIST metadata embedded in the email exports. 8.5 Previously Analyzed vs. New Findings The OCR-based findings (268 documents) represent data visible in the document text and captured by OCR processing. These would be available to anyone examining the documents. The 12 redacted PLIST documents from the redaction analysis are potentially NEW findings, as the PLIST content was hidden beneath redaction overlays and only recovered through the document analysis process. The Cellebrite/forensic device references (17 documents in DS8; 21+ in DS9) provide context about how Apple device data was handled in the case but are visible in the document text. 8.6 Regarding EFTA00524160 EFTA00524160 does not exist in any database. The closest match is EFTA01524160, which is a Ghislaine Maxwell JPMorgan Chase bank statement from April 2003 with no PLIST content whatsoever. The original query about this EFTA number having "PLIST encoding" appears to be based on incorrect information. --- APPENDIX A: Sample PLIST Metadata (EFTA02570954) Full recovered text showing typical Apple Mail PLIST structure: From: [redacted] Sent: Thursday, June 13, 2013 9:43 PM To: [email protected] Salam capt keith holland Sent from my iPhone conversation-id 257285 date-last-viewed 0 date-received 1371159841 [= June 13, 2013 5:44:01 PM] flags 8590195713 ... APPENDIX B: Sample PLIST Metadata with IMAP Mailbox (EFTA02323043) any help/input would be appreciated! Thanks chica flags 8590195713 original-mailbox imap://[email protected]/Sent%20Messages remote-id 4043 APPENDIX C: Cellebrite Apple Device Evidence (EFTA00020322) All electronic images should be viewable as thumbnails, except those seized from Apple devices, which must be viewed using Cellebrite. The Cellebrite software will be provided on the drive for your review of images and videos seized from Apple devices. The electronic files have the same metadata on the hard drive that was available when the FBI seized each image. For images that were carved or deleted, no metadata was recovered, so none is viewable. --- End of Report