-----PAGE 1-----
US. Department of Justice
Office of the Inspector General
REPORT OF FORENSIC EXAMINATION
SUBMITTER
Special Agent
, New York Field Office
OFFICE CONDUCTING EXAMINATION
Cyber Investigations Office
CYBER ID
0384
DATE SUBMITTED
August 13, 2019
CASE NUMBER
2019-010614
SUBJECT(S)
Correctional Officer Michael Thomas, Federal Bureau
of Prisons, Metropolitan Correctional Center, New
York, NY
DIGITAL DEVICE(S) EXAMINED
1. Samsung Galaxy S9 IMEI:
(Device 1 — BOP issued to
2. Samsung Galaxy S9 IMEI:
(Device 2 — BOP issued to
3. Samsung Galaxy S9 IMEI:
(Device 3 — BOP issued to
Synopsis
On August 22, 2019, U.S. Department of Justice Office of the Inspector General (OIG), C ber Investi ations
Office (CYBER) Special Agent (SA)
and Assistant Special Agent in Charge
received and manually reviewed Devices 1-3 at the Federal Bureau of Prisons (BOP) Metropolitan Correctional
Center, located in New York, NY. MI and
were assisted by OIG Washington Field Office SA Gabriel
Ortiz and OIG Fraud Detection Office SA
. Devices 1-3 were BOP issued mobile devices which
were provided to CYBER in order to determine whether or not they contained any unauthorized communication
related to the suicide ofJeffery Epstein.
OIG New York Field Office SA
was investigating alleged BOP employee misconduct related
to Epstein's suicide, and sought the review of Devices 1-3 out of an abundance of caution. There were no
allegations of misconduct against the BOP employees to whom Devices 1-3 had been issued. Accordingly,
CYBER personnel elected to perform only manual reviews of the phones to limit the disruption of service and
to minimize the intrusiveness of the review. In order to fully analyze the BOP devices with forensic tools,
CYBER would have had to have manipulated settings on each phone which would have resulted in a loss of
data and the need to wipe and reissue each one. The manual review did not limit the data CYBER would have
been able to recover using forensic tools for this model phone.
On December 7, 2019,
submitted an OIG Digital Forensics Examination Request form seeking a
review of Devices 1-3 for the aforementioned data.
The CYBER manual review consisted of a search for communication capable applications on each device,
excluding email. Onl .t
iative device messaging application on each device was found to meet the criteria of
the search.
and
reviewed all messages within the application that occurred after Epstein's suicide
SENSITIVE BUT UNCLASSIFIED
EXAMINER NAME AND TITLE:
SA
REVIEWER NAME AND TITLE:
ASAC
SIGNATURE:
SIGNATURE:
OIG Form 111-235/2 (02/I0/I7)
This document contains neither recommendations nor conclusions of the IC It Lt the property of the 1G and is loaned to your agency: it and its
contents are not to be distributed outside of inner agency.
SON Y_001:O8134
EFTA00128627
-----PAGE 2-----
on the morning of August 10, 2019. The search did not reveal any messages that appeared to contain
inappropriate or unauthorized communication related to Epstein's death. Only one message, located on Device
I, was found to relate to the topic of Epstein. The message appeared to be an appropriate exchange that served
to reiterate the staff's instructions not to comment on the ongoing matter. A copy of the message can be viewed
by
All documentation related to this forensic request will be retained by CYBER on the Archive Network Attached
Storage located in the New York City lab under this case number.
A LIMA forensic case management system report containing all examiner process notes, photos, tool details
and forms associated with this request is incorporated by reference, and has been provided to the requestor in
electronic format with this report. The analysis result file provided to
is also included in electronic
format with this report.
SENSITIVE BUT UNCLASSIFIED
Page 2
Case Number
2019-010614
SONY_00005135
EFTA00128628