[EXTERNAL EMAIL] - RE: Morning
I'll be in the lobby of 26 fed in 5 minutes — should we meet you in lobby or go to a specific floor?
Sent from my iPhone
EFTA01659717
Adding ██████
Sent from my iPhone
On Dec 7, 2021, at 8:53 AM wrote:
I'm running a few minutes late. Steve, do you want to grab and get started? I'm close...
Just got called to testify in Maxwell. Court starts at 9:30 and I'm 2nd. I'll reach out when done.
EFTA01659716
I can do 430-530
Otherwise I'm free tomorrow from 9 am-3 pm, but I forget if Wednesday doesn't work for you
Sent from my iPhone
On Dec 7, 2021, at 9:01 AM, wrote:
Good luck
want to stand by for this afternoon in case Steve wraps up this morning?
Ok, but I have a hard stop at 4, so can we start right at 3?
Key information from the email thread regarding a meeting on Tuesday, December 7, 2021:
- 9:59 AM: Suggestion to meet 3-4 PM, mentions Steve. Someone is coming in at 2:30.
- 9:53 AM: Offers to meet 2:45-3:45.
- 9:52 AM: Asks to go earlier, as they flee at 4 PM.
- 9:25:53 AM: Proposes 4:30 PM.
- 9:03:15 AM: Indicates that 4:30 PM wouldn't work as everyone is out tomorrow. Signed "Liz."
Works for me
Things we learned today, thank you for clarifying:
- On one of the harddrives you've populated for us, this is the breakdown.
Key entities and information:
- iCloud Return includes folders related to Apple iCloud backups and associated files like "CellebriteReader.exe" and "Apple iCloud (Backup)_2021-11-09_Report.ufdr"
- askew phone includes an "EvidenceCollection" folder and files like "EvidenceCollection_2021-11-09_Report.ufdr" and "CellebriteReader.exe".
- There are also folders: report small D_b38, report small blended, report D_b38, report D_22 and report blended.
- The disk called "1b1copy thumbdrive from K&L Gates 9/29/2020" is the same as 1B1 on the harddrive, but exported from the FTK imager. The disk version is better to give to defense.
Things that we need to tackle on Thursday, by repopulating the SDNY drive:
- the CD called "working copy of emails" that initially had on it a sticky labelled "lb8" is not 1b8. It might be 1b2.
EFTA01659714
This is the contents of that cd:
| Name | Type | Size | Modified |
|---|---|---|---|
| Report_Files (r) | Folder | — | 12/1/2020 3:53:52 PM |
| Autorun.inf (r) | File | 36 bytes | 12/1/2020 3:53:52 PM |
| Index.html (r) | File | 400 bytes | 12/1/2020 3:53:52 PM |
| Report.fo (r) | File | 79,917,625 bytes (≈76.3 MB) | 12/1/2020 3:59:22 PM |
| Report.pdf (r) | File | 37,566,805 bytes (≈35.8 MB) | 12/1/2020 4:08:27 PM |
All entries show “(r)” (read-only) next to their names.
- 188 on the harddrive is in the access data file type and needs to be read by the FTK imager. Ideally we could dump that out of the program into a type that can be more easily read by defense counsel.
This is the current disk contents:
Name: NYC030127.ad1
Date modified: 11/24/2020 3:45 PM
Type: AD1 File
Size: 16,910 KB
Name: NYC030127.ad1.txt
Date modified: 11/24/2020 3:46 PM
Type: Text Document
Size: 2 KB
- the file called 1B9 contains the full Callie phone. This should NOT be produced as it is. The folder 1B9 was populated with that phone by mistake. [This also might be 1b2.] The true contents of 1B9 has to be re-pulled across from the original- from the folder called "Report" from 2/5/21, last updated at 10:01
questions in blue:
| 11)5 | Just pertinent, john bicks |
|---|---|
| 1b6 | Screenshots, not a phone extraction |
| 1b7 | Just pertinent, calvina bostick |
| lb8 | Is this just pertinent? |
| 1b9 | [needs help] |
| 1b10 | just pertinent, Bicks, callie, whitney, |
| 1b12 | Is this just pertinent?, Askew phone |
this is the music I referred to throughout this afternoon:
Hi all,
I am completely open any time after 2 tomorrow, or I can make a time in the morning work.
Please let me know what you all are thinking.
Thank you,
EFTA01659713
Hello, just trying to figure out tomorrow. Thank you.
Hey
My meeting got a scheduled for 3pm, want to meet from 2-245?
Liz
I am heading across now.
I will not bring a computer, I will bring the bag of devices.
See you in a moment!
Perfect, email when you're downstairs and I'll jump into the elevator.
Thank you both!